diff --git a/CHANGELOG.md b/CHANGELOG.md index c61739843..561cd0d87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,7 +24,10 @@ Versioning](https://semver.org/spec/v2.0.0.html). - Added a utility script to make it easier for maintainers to propose releases, regardless of the git remote configuration. See the previously closed [issue](https://github.com/ComplianceAsCode/compliance-operator/issues/8) for - more details. + +- There was a regression in `quay.io/compliance-operator/test-broken-content:kublet_default` + on OCP 4.12 cluster, which caused the e2e test to fail. Since we have fix the test image, + here we updated datastream xml files for the test content image. ### Deprecations diff --git a/images/testcontent/kubelet_default/ssg-eks-ds.xml b/images/testcontent/kubelet_default/ssg-eks-ds.xml deleted file mode 100644 index 4d1079d7a..000000000 --- a/images/testcontent/kubelet_default/ssg-eks-ds.xml +++ /dev/null @@ -1,8343 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - Amazon Elastic Kubernetes Service - oval:ssg-installed_app_is_eks:def:1 - - - Amazon Elastic Kubernetes Service 1.21 - oval:ssg-installed_app_is_eks_1_21:def:1 - - - Amazon Elastic Kubernetes Service Node - oval:ssg-installed_app_is_eks_node:def:1 - - - - - - draft - Guide to the Secure Configuration of Amazon Elastic Kubernetes Service - This guide presents a catalog of security-relevant -configuration settings for Amazon Elastic Kubernetes Service. It is a rendering of -content structured in the eXtensible Configuration Checklist Description Format (XCCDF) -in order to support security automation. The SCAP content is -is available in the scap-security-guide package which is developed at - - https://www.open-scap.org/security-policies/scap-security-guide. - -Providing system administrators with such guidance informs them how to securely -configure systems under their control in a variety of network roles. Policy -makers and baseline creators can use this catalog of settings, with its -associated references to higher-level security control catalogs, in order to -assist them in security baseline creation. This guide is a catalog, not a -checklist, and satisfaction of every item is not likely to be possible or -sensible in many operational scenarios. However, the XCCDF format enables -granular selection and adjustment of settings, and their association with OVAL -and OCIL content provides an automated checking capability. Transformations of -this document, and its associated automated checking content, are capable of -providing baselines that meet a diverse set of policy objectives. Some example -XCCDF Profiles, which are selections of items that form checklists and -can be used as baselines, are available with this guide. They can be -processed, in an automated fashion, with tools that support the Security -Content Automation Protocol (SCAP). The NIST National Checklist Program (NCP), -which provides required settings for the United States Government, is one example -of a baseline created from this guidance. - - Do not attempt to implement any of the settings in -this guide without first testing them in a non-operational environment. The -creators of this guidance assume no responsibility whatsoever for its use by -other parties, and makes no guarantees, expressed or implied, about its -quality, reliability, or any other characteristic. - - The ComplianceAsCode Project - - https://www.open-scap.org/security-policies/scap-security-guide - - Red Hat and Red Hat Enterprise Linux are either registered -trademarks or trademarks of Red Hat, Inc. in the United States and other -countries. All other names are registered trademarks or trademarks of their -respective companies. - - - - - - - - - - - 0.1.64 - - SCAP Security Guide Project - SCAP Security Guide Project - Frank J Cameron (CAM1244) <cameron@ctc.com> - 0x66656c6978 <0x66656c6978@users.noreply.github.com> - Håvard F. Aasen <havard.f.aasen@pfft.no> - Jack Adolph <jack.adolph@gmail.com> - Edgar Aguilar <edgar.aguilar@oracle.com> - Gabe Alford <redhatrises@gmail.com> - Firas AlShafei <firas.alshafei@us.abb.com> - Rodrigo Alvares <ralvares@redhat.com> - Christopher Anderson <cba@fedoraproject.org> - angystardust <angystardust@users.noreply.github.com> - anivan-suse <anastasija.ivanovic@suse.com> - anixon-rh <55244503+anixon-rh@users.noreply.github.com> - Ikko Ashimine <eltociear@gmail.com> - Chuck Atkins <chuck.atkins@kitware.com> - ayfantis <ayfantis@localhost.localdomain> - Ryan Ballanger <root@rballang-admin-2.fastenal.com> - Alex Baranowski <alex@euro-linux.com> - Eduardo Barretto <eduardo.barretto@canonical.com> - Molly Jo Bault <Molly.Jo.Bault@ballardtech.com> - Andrew Becker <A-Beck@users.noreply.github.com> - Gabriel Becker <ggasparb@redhat.com> - Alexander Bergmann <abergmann@suse.com> - Dale Bewley <dale@bewley.net> - Jose Luis BG <bgjoseluis@gmail.com> - binyanling <binyanling@uniontech.com> - Joseph Bisch <joseph.bisch@gmail.com> - Jeffrey Blank <blank@eclipse.ncsc.mil> - Olivier Bonhomme <ptitoliv@ptitoliv.net> - Lance Bragstad <lbragstad@gmail.com> - Ted Brunell <tbrunell@redhat.com> - Marcus Burghardt <maburgha@redhat.com> - Matthew Burket <mburket@redhat.com> - Blake Burkhart <blake.burkhart@us.af.mil> - Patrick Callahan <pmc@patrickcallahan.com> - George Campbell <gcampbell@palantir.com> - Nick Carboni <ncarboni@redhat.com> - Carlos <64919342+carlosmmatos@users.noreply.github.com> - James Cassell <james.cassell@ll.mit.edu> - Frank Caviggia <fcaviggi@ra.iad.redhat.com> - Eric Christensen <echriste@redhat.com> - Dan Clark <danclark@redhat.com> - Jayson Cofell <1051437+70k10@users.noreply.github.com> - Caleb Cooper <coopercd@ornl.gov> - Richard Maciel Costa <richard.maciel.costa@canonical.com> - Deric Crago <deric.crago@gmail.com> - crleekwc <crleekwc@gmail.com> - cyarbrough76 <42849651+cyarbrough76@users.noreply.github.com> - Maura Dailey <maura@eclipse.ncsc.mil> - Klaas Demter <demter@atix.de> - dhanushkar-wso2 <dhanushkar@wso2.com> - Andrew DiPrinzio <andrew.diprinzio@jhuapl.edu> - dom <dominique.blaze@devinci.fr> - Jean-Baptiste Donnette <jean-baptiste.donnette@epita.fr> - Marco De Donno <mdedonno1337@gmail.com> - dperrone <dperrone@redhat.com> - drax <applezip@gmail.com> - Sebastian Dunne <sdunne@redhat.com> - François Duthilleul <francoisduthilleul@gmail.com> - Greg Elin <gregelin@gitmachines.com> - eradot4027 <jrtonmac@gmail.com> - Alexis Facques <alexis.facques@mythalesgroup.io> - Leah Fisher <lfisher047@gmail.com> - Yavor Georgiev <strandjata@gmail.com> - Alijohn Ghassemlouei <alijohn@secureagc.com> - Swarup Ghosh <swghosh@redhat.com> - ghylock <ghylock@gmail.com> - Andrew Gilmore <agilmore2@gmail.com> - Joshua Glemza <jglemza@nasa.gov> - Nick Gompper <forestgomp@yahoo.com> - Loren Gordon <lorengordon@users.noreply.github.com> - Patrik Greco <sikevux@sikevux.se> - Steve Grubb <sgrubb@redhat.com> - guangyee <gyee@suse.com> - Marek Haicman <mhaicman@redhat.com> - Vern Hart <vern.hart@canonical.com> - Alex Haydock <alex@alexhaydock.co.uk> - Rebekah Hayes <rhayes@corp.rivierautilities.com> - Trey Henefield <thenefield@gmail.com> - Henning Henkel <henning.henkel@helvetia.ch> - hex2a <hex2a@users.noreply.github.com> - John Hooks <jhooks@starscream.pa.jhbcomputers.com> - Jakub Hrozek <jhrozek@redhat.com> - De Huo <De.Huo@windriver.com> - Robin Price II <robin@redhat.com> - Yasir Imam <yimam@redhat.com> - Jiri Jaburek <jjaburek@redhat.com> - Keith Jackson <keithkjackson@gmail.com> - Jeremiah Jahn <jeremiah@goodinassociates.com> - Jakub Jelen <jjelen@redhat.com> - Jessicahfy <Jessicahfy@users.noreply.github.com> - Stephan Joerrens <Stephan.Joerrens@fiduciagad.de> - Hunter Jones <hjones2199@gmail.com> - Jono <jono@ubuntu-18.localdomain> - justchris1 <justchris1@justchris1.email> - Kai Kang <kai.kang@windriver.com> - Charles Kernstock <charles.kernstock@ultra-ats.com> - Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com> - Sherine Khoury <skhoury@redhat.com> - Nathan Kinder <nkinder@redhat.com> - Lee Kinser <lee.kinser@gmail.com> - Evgeny Kolesnikov <ekolesni@redhat.com> - Peter 'Pessoft' Kolínek <github@pessoft.com> - Luke Kordell <luke.t.kordell@lmco.com> - Malte Kraus <malte.kraus@suse.com> - Seth Kress <seth.kress@dsainc.com> - Felix Krohn <felix.krohn@helvetia.ch> - kspargur <kspargur@kspargur.csb> - Amit Kumar <amitkuma@redhat.com> - Fen Labalme <fen@civicactions.com> - Ade Lee <alee@redhat.com> - Christopher Lee <Crleekwc@gmail.com> - Ian Lee <lee1001@llnl.gov> - Jarrett Lee <jarrettl@umd.edu> - Joseph Lenox <joseph.lenox@collins.com> - Jan Lieskovsky <jlieskov@redhat.com> - Markus Linnala <Markus.Linnala@knowit.fi> - Šimon Lukašík <slukasik@redhat.com> - Milan Lysonek <mlysonek@redhat.com> - Fredrik Lysén <fredrik@pipemore.se> - Caitlin Macleod <caitelatte@gmail.com> - Nick Maludy <nmaludy@gmail.com> - Lokesh Mandvekar <lsm5@fedoraproject.org> - Matus Marhefka <mmarhefk@redhat.com> - Jamie Lorwey Martin <jlmartin@redhat.com> - Carlos Matos <cmatos@redhat.com> - Robert McAllister <rmcallis@redhat.com> - Karen McCarron <kmccarro@redhat.com> - Michael McConachie <michael@redhat.com> - Marcus Meissner <meissner@suse.de> - Khary Mendez <kmendez@redhat.com> - Rodney Mercer <rmercer@harris.com> - mgjadoul <mgjadoul@laptomatic.auth-o-matic.corp> - Matt Micene <nzwulfin@gmail.com> - Brian Millett <bmillett@gmail.com> - Takuya Mishina <tmishina@jp.ibm.com> - Mixer9 <35545791+Mixer9@users.noreply.github.com> - mmosel <mmosel@kde.example.com> - Zbynek Moravec <zmoravec@redhat.com> - Kazuo Moriwaka <moriwaka@users.noreply.github.com> - Michael Moseley <michael@eclipse.ncsc.mil> - Renaud Métrich <rmetrich@redhat.com> - Joe Nall <joe@nall.com> - Neiloy <neiloy@redhat.com> - Axel Nennker <axel@nennker.de> - Michele Newman <mnewman@redhat.com> - Sean O'Keeffe <seanokeeffe797@gmail.com> - Jiri Odehnal <jodehnal@redhat.com> - Ilya Okomin <ilya.okomin@oracle.com> - Kaustubh Padegaonkar <theTuxRacer@gmail.com> - Michael Palmiotto <mpalmiotto@tresys.com> - Eryx Paredes <eryxp@lyft.com> - Max R.D. Parmer <maxp@trystero.is> - Arnaud Patard <apatard@hupstream.com> - Jan Pazdziora <jpazdziora@redhat.com> - pcactr <paul.c.arnold4.ctr@mail.mil> - Kenneth Peeples <kennethwpeeples@gmail.com> - Nathan Peters <Nathaniel.Peters@ca.com> - Frank Lin PIAT <fpiat@klabs.be> - Stefan Pietsch <mail.ipv4v6+gh@gmail.com> - piggyvenus <piggyvenus@gmail.com> - Vojtech Polasek <vpolasek@redhat.com> - Orion Poplawski <orion@nwra.com> - Nick Poyant <npoyant@redhat.com> - Martin Preisler <mpreisle@redhat.com> - Wesley Ceraso Prudencio <wcerasop@redhat.com> - Raphael Sanchez Prudencio <rsprudencio@redhat.com> - T.O. Radzy Radzykewycz <radzy@windriver.com> - Kenyon Ralph <kenyon@kenyonralph.com> - Mike Ralph <mralph@redhat.com> - Federico Ramirez <federico.r.ramirez@oracle.com> - rchikov <rumen.chikov@suse.com> - Rick Renshaw <Richard_Renshaw@xtoenergy.com> - Chris Reynolds <c.reynolds82@gmail.com> - rhayes <rhayes@rivierautilities.com> - Pat Riehecky <riehecky@fnal.gov> - rlucente-se-jboss <rlucente@redhat.com> - Juan Antonio Osorio Robles <juan.osoriorobles@eu.equinix.com> - Matt Rogers <mrogers@redhat.com> - Jesse Roland <jesse.roland@onyxpoint.com> - Joshua Roys <roysjosh@gmail.com> - rrenshaw <bofh69@yahoo.com> - Chris Ruffalo <chris.ruffalo@gmail.com> - rumch-se <77793453+rumch-se@users.noreply.github.com> - Ray Shaw (Cont ARL/CISD) rvshaw <rvshaw@esme.arl.army.mil> - Earl Sampson <ESampson@suse.com> - sampsone <esampson@suse.com> - Willy Santos <wsantos@redhat.com> - Nagarjuna Sarvepalli <snagarju@redhat.com> - Anderson Sasaki <33833274+ansasaki@users.noreply.github.com> - Gautam Satish <gautams@hpe.com> - Watson Sato <wsato@redhat.com> - Satoru SATOH <satoru.satoh@gmail.com> - Alexander Scheel <ascheel@redhat.com> - Bryan Schneiders <pschneiders@trisept.com> - shaneboulden <shane.boulden@gmail.com> - Vincent Shen <47534281+Vincent056@users.noreply.github.com> - Dhriti Shikhar <dhriti.shikhar.rokz@gmail.com> - Spencer Shimko <sshimko@tresys.com> - Mark Shoger <mshoger@redhat.com> - THOBY Simon <Simon.THOBY@viveris.fr> - Thomas Sjögren <konstruktoid@users.noreply.github.com> - Francisco Slavin <fslavin@tresys.com> - David Smith <dsmith@eclipse.ncsc.mil> - Kevin Spargur <kspargur@redhat.com> - Kenneth Stailey <kstailey.lists@gmail.com> - Leland Steinke <leland.j.steinke.ctr@mail.mil> - Justin Stephenson <jstephen@redhat.com> - Brian Stinson <brian@bstinson.com> - Jake Stookey <jakestookey@gmail.com> - Jonathan Sturges <jsturges@redhat.com> - Ian Tewksbury <itewk@redhat.com> - Philippe Thierry <phil@reseau-libre.net> - Derek Thurston <thegrit@gmail.com> - tianzhenjia <jiatianzhen@cmss.chinamobile.com> - Greg Tinsley <gtinsley@redhat.com> - Paul Tittle <ptittle@cmf.nrl.navy.mil> - tom <tom@localhost.localdomain> - tomas.hudik <tomas.hudik@embedit.cz> - Jeb Trayer <jeb.d.trayer@uscg.mil> - TrilokGeer <tgeer@redhat.com> - Viktors Trubovics <viktors.trubovics@suse.com> - Nico Truzzolino <nico.truzzolino@gmx.de> - Brian Turek <brian.turek@gmail.com> - Matěj Týč <matyc@redhat.com> - VadimDor <29509093+VadimDor@users.noreply.github.com> - Trevor Vaughan <tvaughan@onyxpoint.com> - vtrubovics <82443408+vtrubovics@users.noreply.github.com> - Samuel Warren <swarren@redhat.com> - wcushen <54533890+wcushen@users.noreply.github.com> - Shawn Wells <shawn@shawndwells.io> - Daniel E. White <linuxdan@users.noreply.github.com> - Bernhard M. Wiedemann <bwiedemann@suse.de> - Roy Williams <roywilli@roywilli.redhat.com> - Willumpie <willumpie@xs4all.nl> - Rob Wilmoth <rwilmoth@redhat.com> - Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - Xirui Yang <xirui.yang@oracle.com> - yarunachalam <yarunachalam@suse.com> - Guang Yee <guang.yee@suse.com> - Achilleas John Yfantis <ayfantis@redhat.com> - YiLin.Li <YiLin.Li@linux.alibaba.com> - YuQing <yyq0391@163.com> - Kevin Zimmerman <kevin.zimmerman@kitware.com> - Luigi Mario Zuccarelli <luzuccar@redhat.com> - Jan Černý <jcerny@redhat.com> - Michal Šrubař <msrubar@redhat.com> - https://github.com/ComplianceAsCode/content/releases/latest - - - CIS Amazon Elastic Kubernetes Service (EKS) Benchmark - Node - This profile defines a baseline that aligns to the Center for Internet Security® -Amazon Elastic Kubernetes Service (EKS) Benchmark™, V1.0.1. - -This profile includes Center for Internet Security® -Amazon Elastic Kubernetes Service (EKS)™ content. - -This profile is applicable to EKS 1.21 and greater. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - CIS Amazon Elastic Kubernetes Service Benchmark - Platform - This profile defines a baseline that aligns to the Center for Internet Security® -Amazon Elastic Kubernetes Service (EKS) Benchmark™, V1.0.1. - -This profile includes Center for Internet Security® -Amazon Elastic Kubernetes Service (EKS)™ content. - -This profile is applicable to EKS 1.21 and greater. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Introduction - The purpose of this guidance is to provide security configuration -recommendations and baselines for Amazon Elastic Kubernetes Service. -The guide is intended for system and/or application administrators. Readers are assumed to -possess basic system administration skills for the application's operating systems, as well -as some familiarity with the product's documentation and administration -conventions. Some instructions within this guide are complex. -All directions should be followed completely and with understanding of -their effects in order to avoid serious adverse effects on the system -and its security. - - General Principles - The following general principles motivate much of the advice in this -guide and should also influence any configuration decisions that are -not explicitly covered. - - Encrypt Transmitted Data Whenever Possible - Data transmitted over a network, whether wired or wireless, is susceptible -to passive monitoring. Whenever practical solutions for encrypting -such data exist, they should be applied. Even if data is expected to -be transmitted only over a local network, it should still be encrypted. -Encrypting authentication data, such as passwords, is particularly -important. Networks of Amazon Elastic Kubernetes Service machines can and should be configured -so that no unencrypted authentication data is ever transmitted between -machines. - - - Least Privilege - Grant the least privilege necessary for user accounts and software to perform tasks. -For example, sudo can be implemented to limit authorization to super user -accounts on the system only to designated personnel. Another example is to limit -logins on server systems to only those administrators who need to log into them in -order to perform administration tasks. - - - Run Different Network Services on Separate Systems - Whenever possible, a server should be dedicated to serving exactly one -network service. This limits the number of other services that can -be compromised in the event that an attacker is able to successfully -exploit a software flaw in one network service. - - - Configure Security Tools to Improve System Robustness - Several tools exist which can be effectively used to improve a system's -resistance to and detection of unknown attacks. These tools can improve -robustness against attack at the cost of relatively little configuration -effort. - - - - How to Use This Guide - Readers should heed the following points when using the guide. - - Formatting Conventions - Commands intended for shell execution, as well as configuration file text, -are featured in a monospace font. Italics are used -to indicate instances where the system administrator must substitute -the appropriate information into a command or configuration file. - - - Read Sections Completely and in Order - Each section may build on information and recommendations discussed in -prior sections. Each section should be read and understood completely; -instructions should never be blindly applied. Relevant discussion may -occur after instructions for an action. - - - Reboot Required - A system or service reboot is implicitly required after some actions in order to -complete the reconfiguration of the system. In many cases, the changes -will not take effect until a reboot is performed. In order to ensure -that changes are applied properly and to test functionality, always -reboot the system after applying a set of recommendations from this guide. - - - Root Shell Environment Assumed - Most of the actions listed in this document are written with the -assumption that they will be executed by the root user running the -/bin/bash shell. Commands preceded with a hash mark (#) -assume that the administrator will execute the commands as root, i.e. -apply the command via sudo whenever possible, or use -su to gain root privileges if sudo cannot be -used. Commands which can be executed as a non-root user are are preceded -by a dollar sign ($) prompt. - - - Test in Non-Production Environment - This guidance should always be tested in a non-production environment -before deployment. This test environment should simulate the setup in -which the system will be deployed as closely as possible. - - - - - Kubernetes Settings - Each section of this configuration guide includes information about the -configuration of a Kubernetes cluster and a set of recommendations for -hardening the configuration. For each hardening recommendation, information -on how to implement the control and/or how to verify or audit the control -is provided. In some cases, remediation information is also provided. - -Some of the settings in the hardening guide are in place by default. The -audit information for these settings is provided in order to verify that -the cluster admininstrator has not made changes that would be less secure. -A small number of items require configuration. - -Finally, there are some recommendations that require decisions by the -system operator, such as audit log size, retention, and related settings. - - Root of files obtained from OCP nodes - When scanning OpenShift clusters, some settings are not exposed as files. -In the case that they are exported from the cluster (typically as yaml files), -this variable determines the directory where they will end up. - /kubernetes-api-resources - - - Kubernetes - Account and Access Control - In traditional Unix security, if an attacker gains -shell access to a certain login account, they can perform any action -or access any file to which that account has access. The same -idea applies to cloud technology such as Kubernetes. Therefore, -making it more difficult for unauthorized people to gain shell -access to accounts, particularly to privileged accounts, is a -necessary part of securing a system. This section introduces -mechanisms for restricting access to accounts under -Kubernetes. - - Use Dedicated Service Accounts - Kubernetes workloads should not use cluster node service accounts to -authenticate to Amazon EKS APIs. Each Kubernetes workload that needs to -authenticate to other AWS services using AWS IAM should be provisioned with a -dedicated Service account. - 5.2.1 - Manual approaches for authenticating Kubernetes workloads running on Amazon -EKS against AWS APIs are: storing service account keys as a Kubernetes secret -(which introduces manual key rotation and potential for key compromise); or -use of the underlying nodes' IAM Service account, which violates the -principle of least privilege on a multi-tenanted node, when one pod needs -to have access to a service, but every other pod on the node that uses the -Service account does not. - CCE-87818-1 - - - - - - - Authentication - In cloud workloads, there are many ways to create and configure -to multiple authentication services. Some of these authentication -methods by not be secure or common methodologies, or they may not -be secure by default. This section introduces mechanisms for -configuring authentication systems Kubernetes. - - OAuth Token Inactivity Timeout - Enter OAuth Token Inactivity Timeout - 10m0s - 10m0s - - - Manage Users with AWS IAM - Amazon EKS uses IAM to provide authentication to your Kubernetes cluster -through the AWS IAM Authenticator for Kubernetes. You can configure the stock -kubectl client to work with Amazon EKS by installing the AWS IAM -Authenticator for Kubernetes and modifying your kubectl configuration file to -use it for authentication. - 5.5.1 - On- and off-boarding users is often difficult to automate and prone to error. -Using a single source of truth for user permissions reduces the number of -locations that an individual must be off-boarded from, and prevents users -gaining unique permissions sets that increase the cost of audit. - CCE-86301-9 - - - - - - - Kubernetes - General Security Practices - Contains evaluations for general security practices for operating a Kubernetes environment. - - Consider Fargate for Untrusted Workloads - It is Best Practice to restrict or fence untrusted workloads when running in -a multi-tenant environment. - 5.6.1 - AWS Fargate is a technology that provides on-demand, right-sized compute -capacity for containers. With AWS Fargate, you no longer have to provision, -configure, or scale groups of virtual machines to run containers. This -removes the need to choose server types, decide when to scale your node -groups, or optimize cluster packing. - -You can control which pods start on Fargate and how they run with Fargate -profiles, which are defined as part of your Amazon EKS cluster. - -Amazon EKS integrates Kubernetes with AWS Fargate by using controllers that -are built by AWS using the upstream, extensible model provided by Kubernetes. -These controllers run as part of the Amazon EKS managed Kubernetes control -plane and are responsible for scheduling native Kubernetes pods onto Fargate. -The Fargate controllers include a new scheduler that runs alongside the -default Kubernetes scheduler in addition to several mutating and validating -admission controllers. When you start a pod that meets the criteria for -running on Fargate, the Fargate controllers running in the cluster recognize, -update, and schedule the pod onto Fargate. - -Each pod running on Fargate has its own isolation boundary and does not share -the underlying kernel, CPU resources, memory resources, or elastic network -interface with another pod. - CCE-89091-3 - - - - - - - Kubernetes Kubelet Settings - The Kubernetes Kubelet is an agent that runs on each node in the cluster. It -makes sure that containers are running in a pod. - -The kubelet takes a set of PodSpecs that are provided through various -mechanisms and ensures that the containers described in those PodSpecs are -running and healthy. The kubelet doesn’t manage containers which were not -created by Kubernetes. - - Configure Kubelet Event Limit - Maximum event creations per second. - 5 - - - kubelet - Authorization Options - ABAC - Attribute-Based Access Control (ABAC) mode allows you to configure policies using local files. -RBAC - Role-based access control (RBAC) mode allows you to create and store policies using the Kubernetes API. -Webhook - WebHook is an HTTP callback mode that allows you to manage authorization using a remote REST endpoint. -Node Node - authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets. -AlwaysDeny - This flag blocks all requests. Use this flag only for testing. - Webhook - ABAC - RBAC - Webhook - Node - AlwaysDeny - - - Configure Kubelet EvictonHard Image FS Avilable - Image FS Available for the EvictonHard threshold to trigger. - 10% - 5% - 10% - 15% - 20% - - - Configure Kubelet EvictonHard Image FS inodes Free - Image FS inodes Free for the EvictonHard threshold to trigger. - 5% - 5% - 10% - 15% - 20% - - - Configure Kubelet EvictonHard Memory Avilable - Memory Available for the EvictonHard threshold to trigger. - 200Mi - - - Configure Kubelet EvictonHard NodeFS Available - Node FS Available for the EvictonHard threshold to trigger. - 5% - 5% - 10% - 15% - 20% - - - Configure Kubelet EvictonHard Node FS inodes Free - Node FS inodes Free for the EvictonHard threshold to trigger. - 4% - 4% - 5% - 10% - 15% - 20% - - - Configure Kubelet EvictionSoft Image FS Avilable - Image FS Available for the EvictionSoft threshold to trigger. - 15% - 5% - 10% - 15% - 20% - - - Configure Kubelet EvictionSoft Image FS inodes Free - Image FS inodes Free for the EvictionSoft threshold to trigger. - 10% - 5% - 10% - 15% - 20% - - - Configure Kubelet EvictionSoft Memory Avilable - Memory Available for the EvictionSoft threshold to trigger. - 500Mi - - - Configure Kubelet EvictionSoft NodeFS Available - Node FS Available for the EvictionSoft threshold to trigger. - 10% - 5% - 10% - 15% - 20% - - - Configure Kubelet EvictionSoft Node FS inodes Free - Node FS inodes Free for the EvictionSoft threshold to trigger. - 5% - 5% - 10% - 15% - 20% - - - Configure Kubelet use of the Strong Cryptographic Ciphers - Cryptographic Ciphers Available for Kubelet, seperated by comma - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - - - Configure Kubelet use of the Strong Cryptographic Ciphers - Cryptographic Ciphers Available for Kubelet - ^(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)$ - - - Configure which node to scan based on role - Configure which node to scan based on role - worker - master - - - Streaming Connection Timeout Options - Time until connection timeouts. Use (s) for seconds, (m) for minutes, -and (h) for hours. - 5m0s - 5m0s - 10m0s - 30m0s - 1h - 2h - 4h - 6h - 8h - - - Disable Anonymous Authentication to the Kubelet - By default, anonymous access to the Kubelet server is enabled. This -configuration check ensures that anonymous requests to the Kubelet -server are disabled. Edit the Kubelet server configuration file -/etc/kubernetes/kubelet/kubelet-config.json on the kubelet node(s) -and set the below parameter: - -authentication: - ... - anonymous: - enabled: false - ... - - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.1 - When enabled, requests that are not rejected by other configured -authentication methods are treated as anonymous requests. These -requests are then served by the Kubelet server. OpenShift Operators should -rely on authentication to authorize access and disallow anonymous -requests. - - - - - - - - - - Ensure authorization is set to Webhook - Unauthenticated/unauthorized users should have no access to OpenShift nodes. -The Kubelet should be set to only allow Webhook authorization. -To ensure that the Kubelet requires authorization, -validate that authorization is configured to Webhook -in /etc/kubernetes/kubelet/kubelet-config.json: - -authorization: - mode: Webhook - ... - - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.2 - Ensuring that the authorization is configured correctly helps enforce that -unauthenticated/unauthorized users have no access to OpenShift nodes. - - - - - - - - - - kubelet - Configure the Client CA Certificate - By default, the kubelet is not configured with a CA certificate which -can subject the kubelet to man-in-the-middle attacks. - -To configure a client CA certificate, edit the kubelet configuration -file /etc/kubernetes/kubelet/kubelet-config.json -on the kubelet node(s) and set the below parameter: - -authentication: -... - x509: - clientCAFile: /etc/kubernetes/pki/ca.crt -... - - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.3 - Not having a CA certificate for the kubelet will subject the kubelet to possible -man-in-the-middle attacks especially on unsafe or untrusted networks. -Certificate validation for the kubelet allows the API server to validate -the kubelet's identity. - - - - - - - - - - kubelet - Hostname Override handling - Normally, OpenShift lets the kubelet get the hostname from either the -cloud provider itself, or from the node's hostname. This ensures that -the PKI allocated by the deployment uses the appropriate values, is valid -and keeps working throughout the lifecycle of the cluster. IP addresses -are not used, and hence this makes it easier for security analysts to -associate kubelet logs with the appropriate node. - CIP-003-3 R6 - CIP-004-3 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - 3.2.8 - Allowing hostnames to be overridden creates issues around resolving nodes -in addition to TLS configuration, certificate validation, and log correlation -and validation. - - - - - - - kubelet - Enable Certificate Rotation - To enable the kubelet to rotate client certificates, edit the kubelet configuration -file /etc/kubernetes/kubelet/kubelet-config.json -on the kubelet node(s) and set the below parameter: - -... -rotateCertificates: true -... - - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.10 - Allowing the kubelet to auto-update the certificates ensure that there is no downtime -in certificate renewal as well as ensures confidentiality and integrity. - - - - - - - - - - kubelet - Enable Client Certificate Rotation - To enable the kubelet to rotate client certificates, edit the kubelet configuration -file /etc/kubernetes/kubelet/kubelet-config.json -on the kubelet node(s) and set the below parameter: - -featureGates: -... - RotateKubeletClientCertificate: true -... - - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.10 - Allowing the kubelet to auto-update the certificates ensure that there is no downtime -in certificate renewal as well as ensures confidentiality and integrity. - - - - - - - - - - kubelet - Allow Automatic Firewall Configuration - The kubelet has the ability to automatically configure the firewall to allow -the containers required ports and connections to networking resources and destinations -parameters potentially creating a security incident. -To allow the kubelet to modify the firewall, edit the kubelet configuration -file /etc/kubernetes/kubelet/kubelet-config.json -on the kubelet node(s) and set the below parameter: -makeIPTablesUtilChains: true - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.7 - The kubelet should automatically configure the firewall settings to allow access and -networking traffic through. This ensures that when a pod or container is running that -the correct ports are configured as well as removing the ports when a pod or -container is no longer in existence. - - - - - - - - - - kubelet - Enable Protect Kernel Defaults - - -Protect tuned kernel parameters from being overwritten by the kubelet. - - - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.6 - Kernel parameters are usually tuned and hardened by the system administrators -before putting the systems into production. These parameters protect the -kernel and the system. Your kubelet kernel defaults that rely on such -parameters should be appropriately set to match the desired secured system -state. Ignoring this could potentially lead to running pods with undesired -kernel behavior. - - - - - - - - - - kubelet - Enable Server Certificate Rotation - To enable the kubelet to rotate server certificates, edit the kubelet configuration -file /etc/kubernetes/kubelet/kubelet-config.json -on the kubelet node(s) and set the below parameter: - -featureGates: -... - RotateKubeletServerCertificate: true -... - - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.11 - Allowing the kubelet to auto-update the certificates ensure that there is no downtime -in certificate renewal as well as ensures confidentiality and integrity. - - - - - - - - - - kubelet - Do Not Disable Streaming Timeouts - Timouts for streaming connections should not be disabled as they help to prevent -denial-of-service attacks. -To configure streaming connection timeouts, edit the kubelet configuration -file /etc/kubernetes/kubelet/kubelet-config.json -on the kubelet node(s) and set the below parameter: -streamingConnectionIdleTimeout: - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.2.5 - Ensuring connections have timeouts helps to protect against denial-of-service attacks as -well as disconnect inactive connections. In addition, setting connections timeouts helps -to prevent from running out of ephemeral ports. - - - - - - - - - - - kubelet - Ensure that the --read-only-port is secured - Disable the read-only port. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - 3.2.4 - The Kubelet process provides a read-only API in addition to the main Kubelet API. -Unauthenticated access is provided to this read-only API which could possibly retrieve -potentially sensitive information about the cluster. - - - - - - - - - - - OpenShift - Logging Settings - Contains evaluations for the cluster's logging configuration settings. - - Configure the OpenShift Audit Profile - Audit log profiles define how to log requests that come to the OpenShift -API server, the Kubernetes API server, and the OAuth API server. - Default - Default - WriteRequestBodies - AllRequestBodies - - - Ensure Audit Logging is Enabled - The audit logs are part of the EKS managed Kubernetes control plane logs that -are managed by Amazon EKS. Amazon EKS is integrated with AWS CloudTrail, a -service that provides a record of actions taken by a user, role, or an AWS -service in Amazon EKS. CloudTrail captures all API calls for Amazon EKS as -events. The calls captured include calls from the Amazon EKS console and code -calls to the Amazon EKS API operations. - 2.1.1 - Exporting logs and metrics to a dedicated, persistent datastore such as -CloudTrail ensures availability of audit data following a cluster security -event, and provides a central location for analysis of log and metric data -collated from multiple sources. - CCE-87445-3 - - - - - - - Kubernetes - Network Configuration and Firewalls - Most systems must be connected to a network of some -sort, and this brings with it the substantial risk of network -attack. This section discusses the security impact of decisions -about networking which must be made when configuring a system. - -This section also discusses firewalls, network access -controls, and other network security frameworks, which allow -system-level rules to be written that can limit an attackers' ability -to connect to your system. These rules can specify that network -traffic should be allowed or denied from certain IP addresses, -hosts, and networks. The rules can also specify which of the -system's network services are available to particular hosts or -networks. - - Ensure that application Namespaces have Network Policies defined. - Use network policies to isolate traffic in your cluster network. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/networking.k8s.io/v1/networkpolicies - API endpoint, filter with with the jq utility using the following filter - [.items[] | select((.metadata.namespace | startswith("openshift") | not) and (.metadata.namespace | startswith("kube-") | not) and .metadata.namespace != "default") | .metadata.namespace] | unique - and persist it to the local - /apis/networking.k8s.io/v1/networkpolicies#51742b3e87275db9eb7fc6c0286a9e536178a2a83e3670b615ceaf545e7fd300 - file. - /api/v1/namespaces - API endpoint, filter with with the jq utility using the following filter - [.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default")] - and persist it to the local - /api/v1/namespaces#34d4beecc95c65d815d9d48fd4fdcb0c521631852ad088ef74e36d012b0e1e0d - file. - - CIP-003-8 R4 - CIP-003-8 R4.2 - CIP-003-8 R5 - CIP-003-8 R6 - CIP-004-6 R2.2.4 - CIP-004-6 R3 - CIP-007-3 R2 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R6.1 - AC-4 - AC-4(21) - CA-3(5) - CM-6 - CM-6(1) - CM-7 - CM-7(1) - SC-7 - SC-7(3) - SC-7(5) - SC-7(8) - SC-7(12) - SC-7(13) - SC-7(18) - SC-7(10) - SI-4(22) - Req-1.1.4 - Req-1.2 - Req-1.2.1 - Req-1.3.1 - Req-1.3.2 - Req-2.2 - SRG-APP-000038-CTR-000105 - SRG-APP-000039-CTR-000110 - SRG-APP-000141-CTR-000315 - SRG-APP-000141-CTR-000320 - SRG-APP-000142-CTR-000325 - SRG-APP-000142-CTR-000330 - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - SRG-APP-000645-CTR-001410 - 4.3.2 - Running different applications on the same Kubernetes cluster creates a risk of one -compromised application attacking a neighboring application. Network segmentation is -important to ensure that containers can communicate only with those they are supposed -to. When a network policy is introduced to a given namespace, all traffic not allowed -by the policy is denied. However, if there are no network policies in a namespace all -traffic will be allowed into and out of the pods in that namespace. - - - - - - - - - - Ensure Network Policy is Enabled - Use Network Policy to restrict pod to pod traffic within a cluster and -segregate workloads. - 5.4.4 - By default, all pod to pod traffic within a cluster is allowed. Network -Policy creates a pod- level firewall that can be used to restrict traffic -between sources. Pod traffic is restricted by having a Network Policy that -selects it (through the use of labels). Once there is any Network Policy in a -namespace selecting a particular pod, that pod will reject any connections -that are not allowed by any Network Policy. Other pods in the namespace that -are not selected by any Network Policy will continue to accept all traffic. - -Network Policies are managed via the Kubernetes Network Policy API and -enforced by a network plugin, simply creating the resource without a -compatible network plugin to implement it will have no effect. EKS supports -Network Policy enforcement through the use of Calico. - CCE-88207-6 - - - - - - Encrypt Traffic to Load Balancers and Workloads - Encrypt traffic to HTTPS load balancers using TLS certificates. - 5.4.5 - Encrypting traffic between users and your Kubernetes workload is fundamental -to protecting data sent over the web. - CCE-89133-3 - - - - - - Restrict Access to the Control Plane Endpoint - Enable Endpoint Private Access to restrict access to the cluster's control -plane to only an allowlist of authorized IPs. - 5.4.1 - Authorized networks are a way of specifying a restricted range of IP -addresses that are permitted to access your cluster's control plane. -Kubernetes Engine uses both Transport Layer Security (TLS) and authentication -to provide secure access to your cluster's control plane from the public -internet. This provides you the flexibility to administer your cluster from -anywhere; however, you might want to further restrict access to a set of IP -addresses that you control. You can set this restriction by specifying an -authorized network. Restricting access to an authorized network can provide -additional security benefits for your container cluster, including: - -Better protection from outsider attacks: Authorized networks provide an -additional layer of security by limiting external access to a specific set -of addresses you designate, such as those that originate from your -premises. This helps protect access to your cluster in the case of a -vulnerability in the cluster's authentication or authorization -mechanism.Better protection from insider attacks: Authorized networks help protect -your cluster from accidental leaks of master certificates from your -company's premises. Leaked certificates used from outside Amazon EC2 and -outside the authorized IP ranges (for example, from addresses outside your -company) are still denied access. - CCE-86182-3 - - - - - - Ensure Private Endpoint Access - Disable access to the Kubernetes API from outside the node network if it is -not required. - 5.4.2 - In a private cluster, the master node has two endpoints, a private and public -endpoint. The private endpoint is the internal IP address of the master, -behind an internal load balancer in the master's VPC network. Nodes -communicate with the master using the private endpoint. The public endpoint -enables the Kubernetes API to be accessed from outside the master's VPC -network. - -Although Kubernetes API requires an authorized token to perform sensitive -actions, a vulnerability could potentially expose the Kubernetes publically -with unrestricted access. Additionally, an attacker may be able to identify -the current cluster and Kubernetes API version and determine whether it is -vulnerable to an attack. Unless required, disabling public endpoint will help -prevent such threats, and require the attacker to be on the master's VPC -network to perform any attack on the Kubernetes API. - CCE-88813-1 - - - - - - Ensure Cluster Private Nodes - Disable public IP addresses for cluster nodes, so that they only have private -IP addresses. Private Nodes are nodes with no public IP addresses. - 5.4.3 - Disabling public IP addresses on cluster nodes restricts access to only -internal networks, forcing attackers to obtain local network access before -attempting to compromise the underlying Kubernetes hosts. - CCE-88669-7 - - - - - - - Kubernetes - Registry Security Practices - Contains evaluations for Kubernetes registry security practices, and cluster-wide registry configuration. - - Only use approved container registries - Use approved container registries. - 5.1.4 - Allowing unrestricted access to external container registries provides the -opportunity for malicious or unapproved containers to be deployed into the -cluster. Allowlisting only approved container registries reduces this risk. - CCE-86901-6 - - - - - - Ensure Image Vulnerability Scanning - Scan images being deployed to Amazon EKS for vulnerabilities. - 5.1.1 - Vulnerabilities in software packages can be exploited by hackers or malicious -users to obtain unauthorized access to local cloud resources. Amazon ECR and -other third party products allow images to be scanned for known -vulnerabilities. - CCE-88990-7 - - - - - - Ensure Cluster Service Account with read-only access to Amazon ECR - Configure the Cluster Service Account with Storage Object Viewer Role to only -allow read- only access to Amazon ECR. - 5.1.3 - The Cluster Service Account does not require administrative access to Amazon -ECR, only requiring pull access to containers to deploy onto Amazon EKS. -Restricting permissions follows the principles of least privilege and -prevents credentials from being abused beyond the required role. - CCE-86681-4 - - - - - - Minimize user access to Amazon ECR - Restrict user access to Amazon ECR, limiting interaction with build images to -only authorized personnel and service accounts. - 5.1.2 - Weak access control to Amazon ECR may allow malicious users to replace built -images with vulnerable containers. - CCE-89643-1 - - - - - - - Kubernetes Secrets Management - Secrets let you store and manage sensitive information, -such as passwords, OAuth tokens, and ssh keys. -Such information might otherwise be put in a Pod -specification or in an image. - - Ensure Kubernetes Secrets are Encrypted - Encrypt Kubernetes secrets, stored in etcd, using secrets encryption feature -during Amazon EKS cluster creation. - 5.3.1 - Kubernetes can store secrets that pods can access via a mounted volume. -Today, Kubernetes secrets are stored with Base64 encoding, but encrypting is -the recommended approach. Amazon EKS clusters version 1.13 and higher support -the capability of encrypting your Kubernetes secrets using AWS Key Management -Service (KMS) Customer Managed Keys (CMK). The only requirement is to enable -the encryption provider support during EKS cluster creation. - -Use AWS Key Management Service (KMS) keys to provide envelope encryption of -Kubernetes secrets stored in Amazon EKS. Implementing envelope encryption is -considered a security best practice for applications that store sensitive -data and is part of a defense in depth security strategy. - -Application-layer Secrets Encryption provides an additional layer of security -for sensitive data, such as user defined Secrets and Secrets required for the -operation of the cluster, such as service account keys, which are all stored -in etcd. - -Using this functionality, you can use a key, that you manage in AWS KMS, to -encrypt data at the application layer. This protects against attackers in the -event that they manage to gain access to etcd. - CCE-90708-9 - - - - - - - Kubernetes - Worker Node Settings - Contains evaluations for the worker node configuration settings. - - Verify Group Who Owns The Kubelet Configuration File - To properly set the group owner of /etc/kubernetes/kubelet/kubelet-config.json, run the command: $ sudo chgrp root /etc/kubernetes/kubelet/kubelet-config.json - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.1.4 - The kubelet configuration file contains information about the configuration of the -OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. - - - - - - - - - - Verify Group Who Owns The Worker Kubeconfig File - To properly set the group owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chgrp root /var/lib/kubelet/kubeconfig - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - The worker kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - - - - - - - - - - Verify User Who Owns The Kubelet Configuration File - To properly set the owner of /etc/kubernetes/kubelet/kubelet-config.json, run the command: $ sudo chown root /etc/kubernetes/kubelet/kubelet-config.json - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.1.4 - The kubelet configuration file contains information about the configuration of the -OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. - - - - - - - - - - Verify User Who Owns The Worker Kubeconfig File - To properly set the owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chown root /var/lib/kubelet/kubeconfig - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.1.2 - The worker kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - - - - - - - - - - Verify Permissions on The Kubelet Configuration File - -To properly set the permissions of /etc/kubernetes/kubelet/kubelet-config.json, run the command: -$ sudo chmod 0644 /etc/kubernetes/kubelet/kubelet-config.json - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.1.3 - If the kubelet configuration file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the configuration of -an OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. - - - - - - - - - - Verify Permissions on the Worker Kubeconfig File - -To properly set the permissions of /var/lib/kubelet/kubeconfig, run the command: -$ sudo chmod 0644 /var/lib/kubelet/kubeconfig - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 3.1.1 - If the worker kubeconfig file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the administration configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - - - - - - - - - - - - - - - - combine_ovals.py from SCAP Security Guide - ssg: [0, 1, 64], python: 3.10.6 - 5.11 - 2022-08-11T18:55:39 - - - - - Ensure that application Namespaces have Network Policies defined. - - Amazon Elastic Kubernetes Service - - Ensure that application Namespaces have Network Policies defined - - - - - - - - - - - Verify Group Who Owns The Kubelet Configuration File - - Amazon Elastic Kubernetes Service - - This test makes sure that /etc/kubernetes/kubelet/kubelet-config.json is group owned by 0. - - - - - - - - - Verify Group Who Owns The Worker Kubeconfig File - - Amazon Elastic Kubernetes Service - - This test makes sure that /var/lib/kubelet/kubeconfig is group owned by 0. - - - - - - - - - Verify User Who Owns The Kubelet Configuration File - - Amazon Elastic Kubernetes Service - - This test makes sure that /etc/kubernetes/kubelet/kubelet-config.json is owned by 0. - - - - - - - - - Verify User Who Owns The Worker Kubeconfig File - - Amazon Elastic Kubernetes Service - - This test makes sure that /var/lib/kubelet/kubeconfig is owned by 0. - - - - - - - - - Verify Permissions on The Kubelet Configuration File - - Amazon Elastic Kubernetes Service - - This test makes sure that /etc/kubernetes/kubelet/kubelet-config.json has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on the Worker Kubeconfig File - - Amazon Elastic Kubernetes Service - - This test makes sure that /var/lib/kubelet/kubeconfig has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Disable Anonymous Authentication to the Kubelet - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.authentication.anonymous.enabled' all: value equals 'false' - - - - - - - - - Ensure authorization is set to Webhook - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.authorization.mode' all: value equals 'AlwaysAllow' - - - - - - - - - kubelet - Configure the Client CA Certificate - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.authentication.x509.clientCAFile' all: value equals '/etc/kubernetes/pki/ca.crt' - - - - - - - - - kubelet - Hostname Override handling - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.hostname-override' all: value equals '.*' - - - - - - - - - kubelet - Enable Certificate Rotation - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.rotateCertificates' all: value equals 'true' - - - - - - - - - kubelet - Enable Client Certificate Rotation - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.featureGates.RotateKubeletClientCertificate' all: value equals 'false' - - - - - - - - - kubelet - Allow Automatic Firewall Configuration - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.makeIPTablesUtilChains' all: value equals 'true' - - - - - - - - - kubelet - Enable Protect Kernel Defaults - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.protectKernelDefaults' all: value equals 'true' - - - - - - - - - kubelet - Enable Server Certificate Rotation - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.featureGates.RotateKubeletServerCertificate' all: value equals 'true' - - - - - - - - - kubelet - Do Not Disable Streaming Timeouts - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.streamingConnectionIdleTimeout' all: - - - - - - - - - kubelet - Ensure that the --read-only-port is secured - - Amazon Elastic Kubernetes Service - - In the YAML/JSON file '/etc/kubernetes/kubelet/kubelet-config.json' at path '.readOnlyPort' all: value equals '0' - - - - - - - - - package_GConf2_installed - - Amazon Elastic Kubernetes Service - - The RPM package GConf2 should be installed. - - - - - - - - - package_avahi_installed - - Amazon Elastic Kubernetes Service - - The RPM package avahi should be installed. - - - - - - - - - package_dconf_installed - - Amazon Elastic Kubernetes Service - - The RPM package dconf should be installed. - - - - - - - - - package_esc_installed - - Amazon Elastic Kubernetes Service - - The RPM package esc should be installed. - - - - - - - - - package_gdm_installed - - Amazon Elastic Kubernetes Service - - The RPM package gdm should be installed. - - - - - - - - - package_pam_ldap_removed - - Amazon Elastic Kubernetes Service - - The RPM package pam_ldap should be removed. - - - - - - - - - package_prelink_removed - - Amazon Elastic Kubernetes Service - - The RPM package prelink should be removed. - - - - - - - - - package_samba-common_removed - - Amazon Elastic Kubernetes Service - - The RPM package samba-common should be removed. - - - - - - - - - service_syslog_disabled - - Amazon Elastic Kubernetes Service - - The syslog service should be disabled if possible. - - - - - - - - - - - - - sshd_includes_config_files - - Amazon Elastic Kubernetes Service - - Check presence of Include /etc/ssh/sshd_config.d/*.conf in /etc/ssh/sshd_config - - - - - - - - - Check pam_faillock Existence in system-auth - - Amazon Elastic Kubernetes Service - - Check that pam_faillock.so exists in system-auth - - - - - - - - - Check pam_pwquality Existence in system-auth - - Amazon Elastic Kubernetes Service - - Check that pam_pwquality.so exists in system-auth - - - - - - - - - Record Any Attempts to Run semanage - - Amazon Elastic Kubernetes Service - - Test if auditctl is in use for audit rules. - - - - - - - - - Record Any Attempts to Run semanage - - Amazon Elastic Kubernetes Service - - Test if augenrules is enabled for audit rules. - - - - - - - - - Record Events that Modify the System's Network Environment - - Amazon Elastic Kubernetes Service - - The network environment should not be modified by anything other than - administrator action. Any change to network parameters should be audited. - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Network Environment - - Amazon Elastic Kubernetes Service - - The network environment should not be modified by anything other than - administrator action. Any change to network parameters should be audited. - - - - - - - - - - - - - - - - - - - - - - - - 'log_file' Not Set In /etc/audit/auditd.conf - - Amazon Elastic Kubernetes Service - - Verify 'log_file' is not set in /etc/audit/auditd.conf. - - - - - - - - - 'log_group' Not Set To 'root' In /etc/audit/auditd.conf - - Amazon Elastic Kubernetes Service - - Verify 'log_group' is not set to 'root' in - /etc/audit/auditd.conf. - - - - - - - - - - Verify GRUB_DISABLE_RECOVERY Set to true - - Amazon Elastic Kubernetes Service - - GRUB_DISABLE_RECOVERY set to 'true' in - /etc/default/grub - - - - - - - - - Specify Multiple Remote chronyd NTP Servers for Time Data - - Amazon Elastic Kubernetes Service - - Multiple chronyd NTP Servers for time synchronization should be specified. - - - - - - - - - GRUB_CMDLINE_LINUX_DEFAULT existance check - - Amazon Elastic Kubernetes Service - - Check if GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub. - - - - - - - - - Use $kernelopts in /boot/loader/entries/*.conf - - Amazon Elastic Kubernetes Service - - Ensure that grubenv-defined kernel options are referenced in individual boot loader entries - - - - - - - - - Alibaba Cloud Linux 2 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Alibaba Cloud Linux 2 - - - - - - - - - - Alibaba Cloud Linux 3 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Alibaba Cloud Linux 3 - - - - - - - - - - CentOS 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - CentOS 7 - - - - - - - - - - CentOS 8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - CentOS 8 - - - - - - - - - - - CentOS Stream 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - CentOS Stream 9 - - - - - - - - - - - Debian - - Amazon Elastic Kubernetes Service - - The operating system installed is a Debian System - - - - - - - - - - Debian Linux 10 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Debian 10 - - - - - - - - - - Debian Linux 11 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Debian 11 - - - - - - - - - - Debian 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Debian 9 - - - - - - - - - - Installed operating system is Fedora - - Amazon Elastic Kubernetes Service - - - - - - The operating system installed on the system is Fedora - - - - - - - - - - - Oracle Linux 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Oracle Linux 7 - - - - - - - - - - - - Oracle Linux 8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Oracle Linux 8 - - - - - - - - - - - - Oracle Linux 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Oracle Linux 9 - - - - - - - - - - - - openSUSE - - Amazon Elastic Kubernetes Service - - The operating system installed on the system is openSUSE. - - - - - - - - - - openSUSE Leap 15 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is openSUSE Leap 15. - - - - - - - - - - openSUSE Leap 42 - - Amazon Elastic Kubernetes Service - - - - - The operating system installed on the system is openSUSE Leap 42. - - - - - - - - - - Installed operating system is part of the Unix family - - Amazon Elastic Kubernetes Service - - The operating system installed on the system is part of the Unix OS family - - - - - - - - - Red Hat Enterprise Linux CoreOS - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux CoreOS release 4 - - - - - - - - - - - - Red Hat Enterprise Linux 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux 7 - - - - - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux 8 - - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8.0 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.0 - - - - - - - - - Red Hat Enterprise Linux 8.1 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.1 - - - - - - - - - Red Hat Enterprise Linux 8.2 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.2 - - - - - - - - - Red Hat Enterprise Linux 8.3 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.3 - - - - - - - - - Red Hat Enterprise Linux 8.4 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.4 - - - - - - - - - Red Hat Enterprise Linux 8.5 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.5 - - - - - - - - - Red Hat Enterprise Linux 8.6 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.6 - - - - - - - - - Red Hat Enterprise Linux 8.7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.7 - - - - - - - - - Red Hat Enterprise Linux 8.8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.8 - - - - - - - - - Red Hat Enterprise Linux 8.9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.9 - - - - - - - - - Red Hat Enterprise Linux 8.10 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.10 - - - - - - - - - Red Hat Enterprise Linux 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux 9 - - - - - - - - - - - - - - - - Red Hat Virtualization 4 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host. - - - - - - - - - - Scientific Linux 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Scientific Linux 7 - - - - - - - - - - SUSE Linux Enterprise 12 - - Amazon Elastic Kubernetes Service - - - - The operating system installed on the system is - SUSE Linux Enterprise 12. - - - - - - - - - - - - - - SUSE Linux Enterprise 15 - - Amazon Elastic Kubernetes Service - - - - The operating system installed on the system is - SUSE Linux Enterprise 15. - - - - - - - - - - - - - - Ubuntu - - Amazon Elastic Kubernetes Service - - The operating system installed is an Ubuntu System - - - - - - - - - - - Ubuntu 1604 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Ubuntu 1604 - - - - - - - - - - Ubuntu 1804 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Ubuntu 1804 - - - - - - - - - - Ubuntu 2004 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Ubuntu 2004 - - - - - - - - - - UnionTech OS Server 20 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is UnionTech OS Server 20 - - - - - - - - - - Amazon Elastic Kubernetes Service - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is EKS. - - - - - - - - - - Amazon Elastic Kubernetes Service 1.21 - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is Amazon Elastic Kubernetes Service 1.21. - - - - - - - - - - Amazon Elastic Kubernetes Service Node - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is EKS 4. - - - - - - - - - Red Hat Virtualization 4 - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is - Red Hat Virtualization 4. - - - - - - - - - - Package audit is installed - - Amazon Elastic Kubernetes Service - - Checks if package audit is installed. - - - - - - - - - - Package chrony is installed - - Amazon Elastic Kubernetes Service - - Checks if package chrony is installed. - - - - - - - - - - Package gdm is installed - - Amazon Elastic Kubernetes Service - - Checks if package gdm is installed. - - - - - - - - - - Package grub2 is installed - - Amazon Elastic Kubernetes Service - - Checks if package grub2-common is installed. - - - - - - - - - - - - - - Package libuser is installed - - Amazon Elastic Kubernetes Service - - Checks if package libuser is installed. - - - - - - - - - - Package providing /etc/login.defs is installed - - Amazon Elastic Kubernetes Service - - Checks if package providing /etc/login.defs and is installed. - - - - - - - - - - Package net-snmp is installed - - Amazon Elastic Kubernetes Service - - Checks if package net-snmp is installed. - - - - - - - - - - Check if the system doesn't act as an oVirt host or manager - - Amazon Elastic Kubernetes Service - - Check if the system has neither ovirt-host nor ovirt-engine installed. - - - - - - - - - Package nss-pam-ldapd is installed - - Amazon Elastic Kubernetes Service - - Checks if package nss-pam-ldapd is installed. - - - - - - - - - - Package ntp is installed - - Amazon Elastic Kubernetes Service - - Checks if package ntp is installed. - - - - - - - - - - Check if the system acts as an oVirt host or manager - - Amazon Elastic Kubernetes Service - - Check if the system has ovirt-host or ovirt-engine installed - - - - - - - - - - - Package pam is installed - - Amazon Elastic Kubernetes Service - - Checks if package pam is installed. - - - - - - - - - - Package polkit is installed - - Amazon Elastic Kubernetes Service - - Checks if package polkit is installed. - - - - - - - - - - Package postfix is installed - - Amazon Elastic Kubernetes Service - - Checks if package postfix is installed. - - - - - - - - - - Package sssd-common is installed - - Amazon Elastic Kubernetes Service - - Checks if package sssd-common is installed. - - - - - - - - - - Package sudo is installed - - Amazon Elastic Kubernetes Service - - Checks if package sudo is installed. - - - - - - - - - - Package systemd is installed - - Amazon Elastic Kubernetes Service - - Checks if package systemd is installed. - - - - - - - - - - Package tftp-server is installed - - Amazon Elastic Kubernetes Service - - Checks if package tftp-server is installed. - - - - - - - - - - Package tmux is installed - - Amazon Elastic Kubernetes Service - - Checks if package tmux is installed. - - - - - - - - - - Package usbguard is installed - - Amazon Elastic Kubernetes Service - - Checks if package usbguard is installed. - - - - - - - - - - WiFi interface is present - - Amazon Elastic Kubernetes Service - - Checks if any wifi interface is present. - - - - - - - - - - Package yum is installed - - Amazon Elastic Kubernetes Service - - Checks if package yum is installed. - - - - - - - - - - System uses zIPL - - Amazon Elastic Kubernetes Service - - Checks if system uses zIPL bootloader. - - - - - - - - - - Check if the scan target is a container - - Amazon Elastic Kubernetes Service - - Check for presence of files characterizing container filesystems. - - - - - - - - - - - Check if the scan target is a machine - - Amazon Elastic Kubernetes Service - - Check for absence of files characterizing container filesystems. - - - - - - - - - - Kerberos server is older than 1.17-18 - - Amazon Elastic Kubernetes Service - - - Check if version of Kerberos server is lesser than 1.17-18 - - - - - - - - - - Kerberos workstation is older than 1.17-18 - - Amazon Elastic Kubernetes Service - - - Check if version of Kerberos workstation is lesser than 1.17-18 - - - - - - - - - - No CD/DVD drive is configured to automount in /etc/fstab - - Amazon Elastic Kubernetes Service - - Check the /etc/fstab and check if a CD/DVD drive - is not configured for automount. - - - - - - - - - Test that the architecture is aarch64 - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64 - - - - - - - - - Test for different architecture than aarch64 - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64 - - - - - - - - - Test for different architecture than s390x - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x - - - - - - - - - Test that the architecture is ppc64le - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is ppc64le - - - - - - - - - Test that the architecture is s390x - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x - - - - - - - - - Device Files for Removable Media Partitions Does Not Exist on the System - - Amazon Elastic Kubernetes Service - - Verify if device file representing removable partitions - exist on the system - - - - - - - - - SSHD is not required to be installed or requirement not set - - Amazon Elastic Kubernetes Service - - If SSHD is not required, we check it is not installed. If SSH requirement is unset, we are good. - - - - - - - - - - SSHD is required to be installed or requirement not set - - Amazon Elastic Kubernetes Service - - If SSHD is required, we check it is installed. If SSH requirement is unset, we are good. - - - - - - - - - - It doesn't matter if sshd is installed or not - - Amazon Elastic Kubernetes Service - - Test if value sshd_required is 0. - - - - - - - - - OpenSSH Server is 7.4 or newer - - Amazon Elastic Kubernetes Service - - Check if version of OpenSSH Server is equal or higher than 7.4 - - - - - - - - - SSSD is configured to use LDAP - - Amazon Elastic Kubernetes Service - - Identification provider is not set to ad within /etc/sssd/sssd.conf - - - - - - - - - - Non-UEFI system boot mode check - - Amazon Elastic Kubernetes Service - - Check if System boot mode is non-UEFI. - - - - - - - - - - UEFI system boot mode check - - Amazon Elastic Kubernetes Service - - Check if system boot mode is UEFI. - - - - - - - - - - Test for 64-bit Architecture - - Amazon Elastic Kubernetes Service - - Generic test for 64-bit architectures to be used by other tests - - - - - - - - - - - - Test for aarch_64 Architecture - - Amazon Elastic Kubernetes Service - - Generic test for aarch_64 architecture to be used by other tests - - - - - - - - - Test for PPC and PPCLE Architecture - - Amazon Elastic Kubernetes Service - - Generic test for PPC PPC64LE architecture to be used by other tests - - - - - - - - - - Test for s390_64 Architecture - - Amazon Elastic Kubernetes Service - - Generic test for s390_64 architecture to be used by other tests - - - - - - - - - Test for x86 Architecture - - Amazon Elastic Kubernetes Service - - Generic test for x86 architecture to be used by other tests - - - - - - - - - Test for x86_64 Architecture - - Amazon Elastic Kubernetes Service - - Generic test for x86_64 architecture to be used by other tests - - - - - - - - - - - Amazon Elastic Kubernetes Service - - Check /etc/tmux.conf is readable by others - - - - - - - - - Check that file storing USBGuard rules exists and is not empty - - Amazon Elastic Kubernetes Service - - Check that file storing USBGuard rules at /etc/usbguard/rules.conf exists and is not empty - - - - - - - - - Value of 'var_accounts_user_umask' variable represented as octal number - - Amazon Elastic Kubernetes Service - - Value of 'var_accounts_user_umask' variable represented as octal number - - - - - - - - - Value of 'var_removable_partition' variable is set to '/dev/cdrom' - - Amazon Elastic Kubernetes Service - - Verify if value of 'var_removable_partition' variable is set - to '/dev/cdrom' - - - - - - - - - Value of 'var_umask_for_daemons' variable represented as octal number - - Amazon Elastic Kubernetes Service - - Value of 'var_umask_for_daemons' variable represented as octal number - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - [:] - - - - [:].metadata.name - - - oval:ssg-local_variable_counter_configure_network_policies_namespaces:var:1 - - - /etc/kubernetes/kubelet/kubelet-config.json - oval:ssg-symlink_file_groupowner_kubelet_conf_uid_0:ste:1 - oval:ssg-state_file_groupowner_kubelet_conf_gid_0_0:ste:1 - - - /var/lib/kubelet/kubeconfig - oval:ssg-symlink_file_groupowner_worker_kubeconfig_uid_0:ste:1 - oval:ssg-state_file_groupowner_worker_kubeconfig_gid_0_0:ste:1 - - - /etc/kubernetes/kubelet/kubelet-config.json - oval:ssg-symlink_file_owner_kubelet_conf_uid_0:ste:1 - oval:ssg-state_file_owner_kubelet_conf_uid_0_0:ste:1 - - - /var/lib/kubelet/kubeconfig - oval:ssg-symlink_file_owner_worker_kubeconfig_uid_0:ste:1 - oval:ssg-state_file_owner_worker_kubeconfig_uid_0_0:ste:1 - - - /etc/kubernetes/kubelet/kubelet-config.json - oval:ssg-exclude_symlinks__kubelet_conf:ste:1 - oval:ssg-state_file_permissions_kubelet_conf_0_mode_0644or_stricter_:ste:1 - - - /var/lib/kubelet/kubeconfig - oval:ssg-exclude_symlinks__worker_kubeconfig:ste:1 - oval:ssg-state_file_permissions_worker_kubeconfig_0_mode_0644or_stricter_:ste:1 - - - - - - - .authentication.anonymous.enabled - - - - - - - .authorization.mode - - - - - - - .authentication.x509.clientCAFile - - - - - - - .hostname-override - - - - - - - .rotateCertificates - - - - - - - .featureGates.RotateKubeletClientCertificate - - - - - - - .makeIPTablesUtilChains - - - - - - - .protectKernelDefaults - - - - - - - .featureGates.RotateKubeletServerCertificate - - - - - - - .streamingConnectionIdleTimeout - - - - - - - .readOnlyPort - - - GConf2 - - - avahi - - - dconf - - - esc - - - gdm - - - pam_ldap - - - prelink - - - samba-common - - - ^syslog\.(service|socket)$ - ActiveState - - - ^syslog\.(service|socket)$ - LoadState - - - rsyslog - - - /etc/ssh/sshd_config - ^[\s]*Include /etc/ssh/sshd_config\.d/\*\.conf[\s]*$ - 1 - - - /etc/pam.d/system-auth - ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_faillock\.so.*$ - 1 - - - - ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$ - 1 - - - /usr/lib/systemd/system/auditd.service - ^ExecStartPost=\-\/sbin\/auditctl.*$ - 1 - - - /usr/lib/systemd/system/auditd.service - ^(ExecStartPost=\-\/sbin\/augenrules.*$|Requires=augenrules.service) - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/auditd.conf - ^(log_file\s*=\s*.*)$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*log_group[ ]+=[ ]+root[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*log_group[ ]+=.*$ - 1 - - - /etc/default/grub - ^\s*GRUB_DISABLE_RECOVERY=(.*)$ - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^([\s]*server[\s]+.+$){2,}$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT=.*$ - 1 - - - /boot/loader/entries/ - ^.*\.conf$ - ^options(?:\s+.*)?\s+\$kernelopts\b.*$ - 1 - - - alinux-release - - - alinux-release - - - centos-release - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/debian_version - - - /etc/debian_version - ^10.[0-9]+$ - 1 - - - /etc/debian_version - ^11.[0-9]+$ - 1 - - - /etc/debian_version - ^9.[0-9]+$ - 1 - - - fedora-release.* - - - /etc/system-release-cpe - ^cpe:\/o:fedoraproject:fedora:[\d]+$ - 1 - - - oraclelinux-release - - - oraclelinux-release - - - oraclelinux-release - - - openSUSE-release - - - openSUSE-release - - - openSUSE-release - - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)\.\d+"$ - 1 - - - - redhat-release-client - - - redhat-release-workstation - - - redhat-release-server - - - redhat-release-computenode - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - redhat-release-virtualization-host - - - sl-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - /etc/lsb-release - - - /etc/lsb-release - ^DISTRIB_ID=Ubuntu$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=xenial$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=bionic$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=focal$ - 1 - - - uos-release - - - - - - - .gitVersion - - - /var/lib/kubelet/kubeconfig - - - rhvm-appliance - - - audit - - - chrony - - - gdm - - - grub2-common - - - /sys/firmware/opal - - - libuser - - - shadow-utils - - - net-snmp - - - nss-pam-ldapd - - - ntp - - - ovirt-host - - - ovirt-engine - - - pam - - - polkit - - - postfix - - - sssd-common - - - sudo - - - systemd - - - tftp-server - - - tmux - - - usbguard - - - /proc/net/wireless - - - yum - - - s390utils-base - - - /.dockerenv - - - /run/.containerenv - - - krb5-server - - - krb5-workstation - - - /etc/fstab - - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - - - - oval:ssg-sshd_required:var:1 - - - oval:ssg-sshd_required:var:1 - - - oval:ssg-sshd_required:var:1 - - - openssh-server - - - /etc/sssd/sssd.conf - ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$ - 1 - - - /sys/firmware/efi - - - - - - - - - - /etc/tmux.conf - - - ^/etc/usbguard/(rules|rules\.d/.*)\.conf$ - ^.*\S+.*$ - 1 - - - oval:ssg-var_accounts_user_umask_umask_as_number:var:1 - - - oval:ssg-var_removable_partition:var:1 - - - oval:ssg-var_umask_for_daemons_umask_as_number:var:1 - - - - - - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - - false - - - - - AlwaysAllow - - - - - /etc/kubernetes/pki/ca.crt - - - - - .* - - - - - true - - - - - false - - - - - true - - - - - true - - - - - true - - - - - - - - - - 0 - - - - inactive|failed - - - masked - - - ^(true|"true")$ - - - ^2.*$ - - - ^3.*$ - - - ^7.*$ - - - centos - - - 8 - - - centos - - - 9 - - - ^7.*$ - - - ^8.*$ - - - ^9.*$ - - - openSUSE-release - - - ^15.*$ - - - ^42.*$ - - - unix - - - rhcos - - - 4 - - - unix - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - 7 - - - unix - - - ^8.*$ - - - ^8.0*$ - - - ^8.1*$ - - - ^8.2*$ - - - ^8.3*$ - - - ^8.4*$ - - - ^8.5*$ - - - ^8.6*$ - - - ^8.7*$ - - - ^8.8*$ - - - ^8.9*$ - - - ^8.10*$ - - - 8 - - - unix - - - ^9.*$ - - - 9 - - - 0:4.4 - - - ^7.*$ - - - unix - - - ^12.*$ - - - ^12.*$ - - - ^12.*$ - - - unix - - - ^15.*$ - - - ^15.*$ - - - ^15.*$ - - - ^20.*$ - - - - ^.*-eks-.*$ - - - - - ^v1\.21\..* - - - - ^4.*$ - - - 0:1.17-18 - - - 0:1.17-18 - - - ^aarch64$ - - - ^ppc64le$ - - - ^s390x$ - - - 1 - - - 2 - - - 0 - - - 0:7.4 - - - aarch64 - - - ppc64 - - - ppc64le - - - s390x - - - i686 - - - x86_64 - - - true - - - /dev/cdrom - - - - - - - /apis/networking.k8s.io/v1/networkpolicies#51742b3e87275db9eb7fc6c0286a9e536178a2a83e3670b615ceaf545e7fd300 - - - - - - /api/v1/namespaces#34d4beecc95c65d815d9d48fd4fdcb0c521631852ad088ef74e36d012b0e1e0d - - - - - - - - - - - - - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/kubernetes/kubelet/kubelet-config.json - - - - /etc/kubernetes/kubelet/kubelet-config.json - - - /etc/pam.d/system-auth - - - - - - - - /kubernetes-api-resources/version - - - /dev/cdrom - /dev/dvd - /dev/scd0 - /dev/sr0 - - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - - - - - - build_shorthand.py from SCAP Security Guide - ssg: 0.1.64 - 2.0 - 2022-08-11T18:55:40 - - - - Use Dedicated Service Accounts - - ocil:ssg-dedicated_service_accounts_action:testaction:1 - - - - Manage Users with AWS IAM - - ocil:ssg-iam_integration_action:testaction:1 - - - - Consider Fargate for Untrusted Workloads - - ocil:ssg-fargate_action:testaction:1 - - - - Disable Anonymous Authentication to the Kubelet - - ocil:ssg-kubelet_anonymous_auth_worker_action:testaction:1 - - - - Ensure authorization is set to Webhook - - ocil:ssg-kubelet_authorization_mode_worker_action:testaction:1 - - - - kubelet - Configure the Client CA Certificate - - ocil:ssg-kubelet_configure_client_ca_worker_action:testaction:1 - - - - kubelet - Enable Certificate Rotation - - ocil:ssg-kubelet_enable_cert_rotation_worker_action:testaction:1 - - - - kubelet - Enable Client Certificate Rotation - - ocil:ssg-kubelet_enable_client_cert_rotation_action:testaction:1 - - - - kubelet - Allow Automatic Firewall Configuration - - ocil:ssg-kubelet_enable_iptables_util_chains_action:testaction:1 - - - - kubelet - Enable Protect Kernel Defaults - - ocil:ssg-kubelet_enable_protect_kernel_defaults_action:testaction:1 - - - - kubelet - Enable Server Certificate Rotation - - ocil:ssg-kubelet_enable_server_cert_rotation_worker_action:testaction:1 - - - - kubelet - Do Not Disable Streaming Timeouts - - ocil:ssg-kubelet_enable_streaming_connections_worker_action:testaction:1 - - - - kubelet - Ensure that the --read-only-port is secured - - ocil:ssg-kubelet_read_only_port_secured_worker_action:testaction:1 - - - - Ensure Audit Logging is Enabled - - ocil:ssg-audit_logging_action:testaction:1 - - - - Ensure that application Namespaces have Network Policies defined. - - ocil:ssg-configure_network_policies_namespaces_action:testaction:1 - - - - Ensure Network Policy is Enabled - - ocil:ssg-configure_network_policy_action:testaction:1 - - - - Encrypt Traffic to Load Balancers and Workloads - - ocil:ssg-configure_tls_action:testaction:1 - - - - Restrict Access to the Control Plane Endpoint - - ocil:ssg-control_plane_access_action:testaction:1 - - - - Ensure Private Endpoint Access - - ocil:ssg-endpoint_configuration_action:testaction:1 - - - - Ensure Cluster Private Nodes - - ocil:ssg-private_nodes_action:testaction:1 - - - - Only use approved container registries - - ocil:ssg-approved_registries_action:testaction:1 - - - - Ensure Image Vulnerability Scanning - - ocil:ssg-image_scanning_action:testaction:1 - - - - Ensure Cluster Service Account with read-only access to Amazon ECR - - ocil:ssg-read_only_registry_access_action:testaction:1 - - - - Minimize user access to Amazon ECR - - ocil:ssg-registry_access_action:testaction:1 - - - - Ensure Kubernetes Secrets are Encrypted - - ocil:ssg-secret_encryption_action:testaction:1 - - - - Verify Group Who Owns The Kubelet Configuration File - - ocil:ssg-file_groupowner_kubelet_conf_action:testaction:1 - - - - Verify Group Who Owns The Worker Kubeconfig File - - ocil:ssg-file_groupowner_worker_kubeconfig_action:testaction:1 - - - - Verify User Who Owns The Kubelet Configuration File - - ocil:ssg-file_owner_kubelet_conf_action:testaction:1 - - - - Verify User Who Owns The Worker Kubeconfig File - - ocil:ssg-file_owner_worker_kubeconfig_action:testaction:1 - - - - Verify Permissions on The Kubelet Configuration File - - ocil:ssg-file_permissions_kubelet_conf_action:testaction:1 - - - - Verify Permissions on the Worker Kubeconfig File - - ocil:ssg-file_permissions_worker_kubeconfig_action:testaction:1 - - - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - - Audit: - -For each namespace in the cluster, review the rights assigned to the default -service account and ensure that it has no roles or cluster roles bound to it -apart from the defaults. Additionally ensure that the -automountServiceAccountToken: false setting is in place for each -default service account. - -Remediation: - -With IAM roles for service accounts on Amazon EKS clusters, you can associate -an IAM role with a Kubernetes service account. This service account can then -provide AWS permissions to the containers in any pod that uses that service -account. With this feature, you no longer need to provide extended -permissions to the worker node IAM role so that pods on that node can call -AWS APIs. -Applications must sign their AWS API requests with AWS credentials. This -feature provides a strategy for managing credentials for your applications, -similar to the way that Amazon EC2 instance profiles provide credentials to -Amazon EC2 instances. Instead of creating and distributing your AWS -credentials to the containers or using the Amazon EC2 instance’s role, you -can associate an IAM role with a Kubernetes service account. The applications -in the pod’s containers can then use an AWS SDK or the AWS CLI to make API -requests to authorized AWS services. - -The IAM roles for service accounts feature provides the following benefits: - - - Least privilege — By using the IAM roles for service accounts feature, - you no longer need to provide extended permissions to the worker node IAM - role so that pods on that node can call AWS APIs. You can scope IAM - permissions to a service account, and only pods that use that service - account have access to those permissions. This feature also eliminates the - need for third-party solutions such as kiam or kube2iam. - Credential isolation — A container can only retrieve credentials for - the IAM role that is associated with the service account to which it - belongs. A container never has access to credentials that are intended for - another container that belongs to another pod. - Auditability — Access and event logging is available through CloudTrail - to help ensure retrospective auditing. - - -To get started, see Enabling IAM roles for service accounts on your cluster. -For an end-to-end walkthrough using eksctl, see Walkthrough: Updating -a DaemonSet to use IAM for service accounts. - Is it the case that dedicated service accounts are used? - - - - Audit: - -To Audit access to the namespace $NAMESPACE, assume the IAM role -yourIAMRoleName for a user that you created, and then run the following -command: - -$ kubectl get role -n $NAMESPACE -The response lists the RBAC role that has access to this Namespace. - -Remediation: - -Refer to the 'Managing users or IAM roles for your cluster' in Amazon EKS -documentation. - -https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html - Is it the case that authorization and authentication is managed using AWS IAM? - - - - Audit: -Check the existence of Fargate profiles in the Amazon EKS cluster by using: - -aws --region ${AWS_REGION} eks list-fargate-profiles --cluster-name ${CLUSTER_NAME} -Alternatively, to audit for the presence of a Fargate profile node run the -following command: -kubectl get nodes -The response should include a NAME entry starting with "fargate-ip" for -example: -NAME STATUS ROLES AGE VERSION -fargate-ip-192-168-104-74.us-east-2.compute.internal Ready 2m15s v1.14.8-eks - -Remediation: - -Create a Fargate profile for your cluster - -Before you can schedule pods running on Fargate in your cluster, you must define a Fargate -profile that specifies which pods should use Fargate when they are launched. For more -information, see AWS Fargate profile. - -Note -If you created your cluster with eksctl using the --fargate option, -then a Fargate profile has already been created for your cluster with -selectors for all pods in the kube-system and default namespaces. -Use the following procedure to create Fargate profiles for any other -namespaces you would like to use with Fargate. - -via eksctl CLI - -Create your Fargate profile with the following eksctl command, replacing the -variable text with your own values. You must specify a namespace, but the -labels option is not required. -eksctl create fargateprofile --cluster cluster_name --name -fargate_profile_name --namespace kubernetes_namespace --labels key=value - -via AWS Management Console - -To create a Fargate profile for a cluster with the AWS Management Console - - - Open the Amazon EKS console at https://console.aws.amazon.com/eks/home#/clusters. - Choose the cluster to create a Fargate profile for. - Under Fargate profiles, choose Add Fargate profile. - On the Configure Fargate profile page, enter the following information - and choose. For Name, enter a unique name for your Fargate profile. For Pod - execution role, choose the pod execution role to use with your Fargate - profile. Only IAM roles with the eks-fargate-pods.amazonaws.com service principal - are shown. If you do not see any roles listed here, you must create one. For more - information, see Pod execution role. For Subnets, choose the subnets to use - for your pods. By default, all subnets in your cluster's VPC are selected. - Only private subnets are supported for pods running on Fargate; you must - deselect any public subnets. For Tags, you can optionally tag your Fargate - profile. These tags do not propagate to other resources associated with the - profile, such as its pods. - 5. On the Configure pods selection page, enter the following - information and choose Next. list text hereFor Namespace, enter a namespace - to match for pods, such as kube-system or default. list text - here(Optional) Add Kubernetes labels to the selector that pods in the - specified namespace must have to match the selector. For example, you could - add the label infrastructure: fargate to the selector so that only pods in - the specified namespace that also have the infrastructure: fargate - Kubernetes label match the selector. - On the Review and create page, review the information for your Fargate - profile and choose Create. - - Is it the case that untrusted workloads are isolated? - - - - Run the following command on the kubelet node(s): -$ sudo grep -A1 anonymous /etc/kubernetes/kubelet/kubelet-config.json -The output should return enabled: false. - Is it the case that <tt>anonymous</tt> authentication is not set to <tt>false</tt>? - - - - Run the following command on the kubelet node(s): -$ sudo grep -A1 authorization /etc/kubernetes/kubelet/kubelet-config.json -Verify that the output is not set to mode: AlwaysAllow, or missing -(defaults to mode: Webhook). - Is it the case that <tt>authorization-mode</tt> is not configured to <tt>Webhook</tt>? - - - - Run the following command on the kubelet node(s): -$ sudo grep -A1 x509 /etc/kubernetes/kubelet/kubelet-config.json -The output should contain a configured certificate like /etc/kubernetes/pki/ca.crt. - Is it the case that no client CA certificate has been configured? - - - - Run the following command on the kubelet node(s): -$ sudo grep rotateCertificates /etc/kubernetes/kubelet/kubelet-config.json -The output should return nothing or true. - Is it the case that the kubelet cannot rotate client certificate? - - - - Run the following command on the kubelet node(s): -$ sudo grep RotateKubeletClientCertificate /etc/kubernetes/kubelet/kubelet-config.json -The output should return nothing or true. - Is it the case that the kubelet cannot rotate client certificate? - - - - Run the following command on the kubelet node(s): -$ sudo grep makeIPTablesUtilChains /etc/kubernetes/kubelet/kubelet-config.json -The output should return true. - Is it the case that the kubelet cannot modify the firewall settings? - - - - Run the following command on the kubelet node(s): -$ sudo grep protectKernelDefaults /etc/kubernetes/kubelet/kubelet-config.json -The output should return true. - Is it the case that the kubelet can modify kernel parameters? - - - - Run the following command on the kubelet node(s): -$ sudo grep RotateKubeletServerCertificate /etc/kubernetes/kubelet/kubelet-config.json -The output should return true. - Is it the case that the kubelet cannot rotate server certificate? - - - - Run the following command on the kubelet node(s): -$ sudo grep streamingConnectionIdleTimeout /etc/kubernetes/kubelet/kubelet-config.json -The output should return . - Is it the case that the streaming connection timeouts are not disabled? - - - - First, SSH to the relevant node. - -Open the Kubelet config file: - - cat /etc/kubernetes/kubelet/kubelet-config.json - -Verify that the "readOnlyPort" argument exists and is set to 0 - Is it the case that readOnlyPort is not secured? - - - - Perform the following to determine if CloudTrail is enabled for all regions: -Via the Management Console -1. Sign in to the AWS Management Console and open the EKS console at https://console.aws.amazon.com/eks -2. Click on Cluster Name of the cluster you are auditing -3. Click Logging -4. Ensure all 5 choices are set to Enabled -Via CLI -aws --region "${REGION_CODE}" eks describe-cluster --name "${CLUSTER_NAME}" --query 'cluster.logging.clusterLogging[?enabled==true].types' - -Perform the following to determine if CloudTrail is enabled for all regions: -Via The Management Console -1. Sign in to the AWS Management Console and open the EKS console at https://console.aws.amazon.com/eks -2. Click on Cluster Name of the cluster you are auditing -3. Click Logging -4. Select Manage Logging from the button on the right hand side -5. Toggle each selection to the Enabled position. -6. Click Save Changes - Is it the case that audit logging is enable? - - - - Verify that the every non-control plane namespace has an appropriate -NetworkPolicy. - -To get all the non-control plane namespaces, you can do the -following command oc get namespaces -o json | jq '[.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default") | .metadata.name ]' - -To get all the non-control plane namespaces with a NetworkPolicy, you can do the -following command oc get --all-namespaces networkpolicies -o json | jq '[.items[] | select((.metadata.namespace | startswith("openshift") | not) and (.metadata.namespace | startswith("kube-") | not) and .metadata.namespace != "default") | .metadata.namespace] | unique' - -Make sure that the namespaces displayed in the commands of the commands match. - Is it the case that Namespaced Network Policies needs review? - - - - Network Policy requires the Network Policy add-on. This add-on is included -automatically when a cluster with Network Policy is created, but for an -existing cluster, needs to be added prior to enabling Network Policy. - -Enabling/Disabling Network Policy causes a rolling update of all cluster -nodes, similar to performing a cluster upgrade. This operation is -long-running and will block other operations on the cluster (including -delete) until it has run to completion. - -If Network Policy is used, a cluster must have at least 2 nodes of type -n1-standard-1 or higher. The recommended minimum size cluster to run -Network Policy enforcement is 3 n1-standard-1 instances. - -Enabling Network Policy enforcement consumes additional resources in nodes. -Specifically, it increases the memory footprint of the kube-system -process by approximately 128MB, and requires approximately 300 millicores of -CPU. - Is it the case that network policy is enabled? - - - - For more information about protecting your workloads using TLS please refer -to the AWS User Guide: - -https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/data-protection.html - Is it the case that connections to load balancers and workloads are encrypted with TLS? - - - - Audit: -Input: - -aws eks describe-cluster \ ---region region \ ---name clustername -Output: -... -"endpointPublicAccess": false, -"endpointPrivateAccess": true, -"publicAccessCidrs": [ -"203.0.113.5/32" -] -... - -Remediation: -Complete the following steps using the AWS CLI version 1.18.10 or later. You -can check your current version with aws --version. To install or -upgrade the AWS CLI, see Installing the AWS CLI. - -Update your cluster API server endpoint access with the following AWS CLI -command. Substitute your cluster name and desired endpoint access values. If -you set endpointPublicAccess=true, then you can (optionally) enter -single CIDR block, or a comma- separated list of CIDR blocks for -publicAccessCidrs. The blocks cannot include reserved addresses. If you -specify CIDR blocks, then the public API server endpoint will only receive -requests from the listed blocks. There is a maximum number of CIDR blocks -that you can specify. For more information, see Amazon EKS Service Quotas. If -you restrict access to your public endpoint using CIDR blocks, it is -recommended that you also enable private endpoint access so that worker nodes -and Fargate pods (if you use them) can communicate with the cluster. Without -the private endpoint enabled, your public access endpoint CIDR sources must -include the egress sources from your VPC. For example, if you have a worker -node in a private subnet that communicates to the internet through a NAT -Gateway, you will need to add the outbound IP address of the NAT gateway as -part of a whitelisted CIDR block on your public endpoint. If you specify no -CIDR blocks, then the public API server endpoint receives requests from all -(0.0.0.0/0) IP addresses. - -Note -The following command enables private access and public access from a single IP address -for the API server endpoint. Replace 203.0.113.5/32 with a single CIDR block, or a comma- -separated list of CIDR blocks that you want to restrict network access to. - -Example command: - -aws eks update-cluster-config \ ---region region-code \ ---name dev \ ---resources-vpc-config \ -endpointPublicAccess=true, \ -publicAccessCidrs="203.0.113.5/32",\ -endpointPrivateAccess=true - Is it the case that the control plane endpoint is secure? - - - - Configure the EKS cluster endpoint to be private. See Modifying Cluster -Endpoint Access for further information on this topic. -https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html - Is it the case that private acces is enabled and public access is disabled? - - - - To enable Private Nodes, the cluster has to also be configured with a private -master IP range and IP Aliasing enabled. Private Nodes do not have outbound -access to the public internet. - -If you want to provide outbound Internet access for your private nodes, you -can use Cloud NAT or you can manage your own NAT gateway. - Is it the case that clusters are created with private nodes? - - - - Ensure all containers and images are coming from approved registries. - -References: - -https://aws.amazon.com/blogs/opensource/using-open-policy-agent-on-amazon-eks/ - Is it the case that container images come from approved registries? - - - - Please follow AWS ECS or your 3rd party image scanning provider's guidelines -for enabling Image Scanning. - -Remediation: - -To utilize AWS ECR for Image scanning please follow the steps below: - -To create a repository configured for scan on push (AWS CLI) - -aws ecr create-repository --repository-name $REPO_NAME --image-scanning- configuration scanOnPush=true --region $REGION_CODE - -To edit the settings of an existing repository (AWS CLI) - -aws ecr put-image-scanning-configuration --repository-name $REPO_NAME -- image-scanning-configuration scanOnPush=true --region $REGION_CODE - -Use the following steps to start a manual image scan using the AWS Management Console. - -1. Open the Amazon ECR console at https://console.aws.amazon.com/ecr/repositories. -2. From the navigation bar, choose the Region to create your repository in. -3. In the navigation pane, choose Repositories. -4. On the Repositories page, choose the repository that contains the image to scan. -5. On the Images page, select the image to scan and then choose Scan. - Is it the case that image vulnerability scanning is enabled? - - - - Review AWS ECS worker node IAM role (NodeInstanceRole) IAM Policy Permissions -to verify that they are set and the minimum required level. If utilizing a -3rd party tool to scan images utilize the minimum required permission level -required to interact with the cluster - generally this should be read-only. - -Remediation: - -You can use your Amazon ECR images with Amazon EKS, but you need to satisfy -the following prerequisites. -The Amazon EKS worker node IAM role (NodeInstanceRole) that you use with your -worker nodes must possess the following IAM policy permissions for Amazon -ECR. - - -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "ecr:BatchCheckLayerAvailability", - "ecr:BatchGetImage", - "ecr:GetDownloadUrlForLayer", - "ecr:GetAuthorizationToken" - ], - "Resource": "*" - } - ] -} - - Is it the case that Cluster Service Account has read-only access to Amazon ECR? - - - - Remediation: - -Before you use IAM to manage access to Amazon ECR, you should understand what -IAM features are available to use with Amazon ECR. To get a high-level view -of how Amazon ECR and other AWS services work with IAM, see AWS Services That -Work with IAM in the IAM User Guide. - -Topics - - -Amazon ECR Identity-Based Policies -Amazon ECR Resource-Based Policies -Authorization Based on Amazon ECR Tags -Amazon ECR IAM Roles - - -Amazon ECR Identity-Based Policies - -With IAM identity-based policies, you can specify allowed or denied actions -and resources as well as the conditions under which actions are allowed or -denied. Amazon ECR supports specific actions, resources, and condition keys. -To learn about all of the elements that you use in a JSON policy, see IAM -JSON Policy Elements Reference in the IAM User Guide. - -Actions - -The Action element of an IAM identity-based policy describes the specific -action or actions that will be allowed or denied by the policy. Policy -actions usually have the same name as the associated AWS API operation. The -action is used in a policy to grant permissions to perform the associated -operation. - -Policy actions in Amazon ECR use the following prefix before the action: -ecr:. For example, to grant someone permission to create an Amazon ECR -repository with the Amazon ECR CreateRepository API operation, you include -the ecr:CreateRepository action in their policy. Policy statements must -include either an Action or NotAction element. Amazon ECR defines its own set -of actions that describe tasks that you can perform with this service. To -specify multiple actions in a single statement, separate them with commas as -follows: "Action": [ "ecr:action1", "ecr:action2" You can specify -multiple actions using wildcards (*). For example, to specify all -actions that begin with the word Describe, include the following action: -"Action": "ecr:Describe*" To see a list of Amazon ECR actions, see -Actions, Resources, and Condition Keys for Amazon Elastic Container -Registry in the IAM User Guide. - -Resources - -The Resource element specifies the object or objects to which the action -applies. Statements must include either a Resource or a NotResource element. -You specify a resource using an ARN or using the wildcard (*) to -indicate that the statement applies to all resources. - -An Amazon ECR repository resource has the following ARN: -arn:${Partition}:ecr:${Region}:${Account}:repository/${Repository-name} -For more information about the format of ARNs, see Amazon Resource Names -(ARNs) and AWS Service Namespaces. -For example, to specify the my-repo repository in the us-east-1 Region in -your statement, use the following ARN: -"Resource": "arn:aws:ecr:us-east-1:123456789012:repository/my-repo" -To specify all repositories that belong to a specific account, use the -wildcard (*): "Resource": -"arn:aws:ecr:us-east-1:123456789012:repository/*" -To specify multiple resources in a single statement, separate the ARNs with -commas. "Resource": [ "resource1", "resource2" -To see a list of Amazon ECR resource types and their ARNs, see Resources -Defined by Amazon Elastic Container Registry in the IAM User Guide. To learn -with which actions you can specify the ARN of each resource, see Actions -Defined by Amazon Elastic Container Registry. - -Condition Keys - -The Condition element (or Condition block) lets you specify conditions in -which a statement is in effect. The Condition element is optional. You can -build conditional expressions that use condition operators, such as equals or -less than, to match the condition in the policy with values in the request. -If you specify multiple Condition elements in a statement, or multiple keys -in a single Condition element, AWS evaluates them using a logical AND -operation. If you specify multiple values for a single condition key, AWS -evaluates the condition using a logical OR operation. All of the conditions -must be met before the statement's permissions are granted. -You can also use placeholder variables when you specify conditions. For -example, you can grant an IAM user permission to access a resource only if it -is tagged with their IAM user name. For more information, see IAM Policy -Elements: Variables and Tags in the IAM User Guide. -Amazon ECR defines its own set of condition keys and also supports using some global -condition keys. To see all AWS global condition keys, see AWS Global Condition Context -Keys in the IAM User Guide. -Most Amazon ECR actions support the aws:ResourceTag and ecr:ResourceTag -condition keys. For more information, see Using Tag-Based Access Control. To -see a list of Amazon ECR condition keys, see Condition Keys Defined by Amazon -Elastic Container Registry in the IAM User Guide. To learn with which actions -and resources you can use a condition key, see Actions Defined by Amazon -Elastic Container Registry. - Is it the case that access to the container image registry is restricted? - - - - Audit: - -For Amazon EKS clusters with Secrets Encryption enabled, look for -'encryptionConfig' configuration when you run: -aws eks describe-cluster --name="cluster-name" - -Remediation: - -Enable 'Secrets Encryption' during Amazon EKS cluster creation as -described in the links within the 'References' section. - -References: - - https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html - https://eksworkshop.com/beginner/191_secrets/ - - Is it the case that kubernetes secrets are encrypted in etcd? - - - - To check the group ownership of /etc/kubernetes/kubelet/kubelet-config.json, -run the command: -$ ls -lL /etc/kubernetes/kubelet/kubelet-config.json -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/kubernetes/kubelet/kubelet-config.json does not have a group owner of root? - - - - To check the group ownership of /var/lib/kubelet/kubeconfig, -run the command: -$ ls -lL /var/lib/kubelet/kubeconfig -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /var/lib/kubelet/kubeconfig does not have a group owner of root? - - - - To check the ownership of /etc/kubernetes/kubelet/kubelet-config.json, -run the command: -$ ls -lL /etc/kubernetes/kubelet/kubelet-config.json -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/kubernetes/kubelet/kubelet-config.json does not have an owner of root? - - - - To check the ownership of /var/lib/kubelet/kubeconfig, -run the command: -$ ls -lL /var/lib/kubelet/kubeconfig -If properly configured, the output should indicate the following owner: -root - Is it the case that /var/lib/kubelet/kubeconfig does not have an owner of root? - - - - To check the permissions of /etc/kubernetes/kubelet/kubelet-config.json, -run the command: -$ ls -l /etc/kubernetes/kubelet/kubelet-config.json -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /etc/kubernetes/kubelet/kubelet-config.json does not have unix mode -rw-r--r--? - - - - To check the permissions of /var/lib/kubelet/kubeconfig, -run the command: -$ ls -l /var/lib/kubelet/kubeconfig -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /var/lib/kubelet/kubeconfig does not have unix mode -rw-r--r--? - - - - - - - - - combine_ovals.py from SCAP Security Guide - ssg: [0, 1, 64], python: 3.10.6 - 5.11 - 2022-08-11T18:55:39 - - - - - Alibaba Cloud Linux 2 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Alibaba Cloud Linux 2 - - - - - - - - - Alibaba Cloud Linux 3 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Alibaba Cloud Linux 3 - - - - - - - - - CentOS 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - CentOS 7 - - - - - - - - - CentOS 8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - CentOS 8 - - - - - - - - - - CentOS Stream 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - CentOS Stream 9 - - - - - - - - - - Debian - - Amazon Elastic Kubernetes Service - - The operating system installed is a Debian System - - - - - - - - - Debian Linux 10 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Debian 10 - - - - - - - - - Debian Linux 11 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Debian 11 - - - - - - - - - Debian 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Debian 9 - - - - - - - - - Installed operating system is Fedora - - Amazon Elastic Kubernetes Service - - - - - - The operating system installed on the system is Fedora - - - - - - - - - - Oracle Linux 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Oracle Linux 7 - - - - - - - - - - - Oracle Linux 8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Oracle Linux 8 - - - - - - - - - - - Oracle Linux 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Oracle Linux 9 - - - - - - - - - - - openSUSE - - Amazon Elastic Kubernetes Service - - The operating system installed on the system is openSUSE. - - - - - - - - - openSUSE Leap 15 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is openSUSE Leap 15. - - - - - - - - - openSUSE Leap 42 - - Amazon Elastic Kubernetes Service - - - - - The operating system installed on the system is openSUSE Leap 42. - - - - - - - - - Installed operating system is part of the Unix family - - Amazon Elastic Kubernetes Service - - The operating system installed on the system is part of the Unix OS family - - - - - - - - Red Hat Enterprise Linux CoreOS - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux CoreOS release 4 - - - - - - - - - - - Red Hat Enterprise Linux 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux 7 - - - - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux 8 - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8.0 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.0 - - - - - - - - Red Hat Enterprise Linux 8.1 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.1 - - - - - - - - Red Hat Enterprise Linux 8.2 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.2 - - - - - - - - Red Hat Enterprise Linux 8.3 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.3 - - - - - - - - Red Hat Enterprise Linux 8.4 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.4 - - - - - - - - Red Hat Enterprise Linux 8.5 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.5 - - - - - - - - Red Hat Enterprise Linux 8.6 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.6 - - - - - - - - Red Hat Enterprise Linux 8.7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.7 - - - - - - - - Red Hat Enterprise Linux 8.8 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.8 - - - - - - - - Red Hat Enterprise Linux 8.9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.9 - - - - - - - - Red Hat Enterprise Linux 8.10 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Red Hat Enterprise Linux 8.10 - - - - - - - - Red Hat Enterprise Linux 9 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Enterprise Linux 9 - - - - - - - - - - - - - - - Red Hat Virtualization 4 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host. - - - - - - - - - Scientific Linux 7 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is - Scientific Linux 7 - - - - - - - - - SUSE Linux Enterprise 12 - - Amazon Elastic Kubernetes Service - - - - The operating system installed on the system is - SUSE Linux Enterprise 12. - - - - - - - - - - - - - SUSE Linux Enterprise 15 - - Amazon Elastic Kubernetes Service - - - - The operating system installed on the system is - SUSE Linux Enterprise 15. - - - - - - - - - - - - - Ubuntu - - Amazon Elastic Kubernetes Service - - The operating system installed is an Ubuntu System - - - - - - - - - - Ubuntu 1604 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Ubuntu 1604 - - - - - - - - - Ubuntu 1804 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Ubuntu 1804 - - - - - - - - - Ubuntu 2004 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is Ubuntu 2004 - - - - - - - - - UnionTech OS Server 20 - - Amazon Elastic Kubernetes Service - - - The operating system installed on the system is UnionTech OS Server 20 - - - - - - - - - Amazon Elastic Kubernetes Service - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is EKS. - - - - - - - - - Amazon Elastic Kubernetes Service 1.21 - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is Amazon Elastic Kubernetes Service 1.21. - - - - - - - - - Amazon Elastic Kubernetes Service Node - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is EKS 4. - - - - - - - - Red Hat Virtualization 4 - - Amazon Elastic Kubernetes Service - - - The application installed installed on the system is - Red Hat Virtualization 4. - - - - - - - - - Package audit is installed - - Amazon Elastic Kubernetes Service - - Checks if package audit is installed. - - - - - - - - - Package chrony is installed - - Amazon Elastic Kubernetes Service - - Checks if package chrony is installed. - - - - - - - - - Package gdm is installed - - Amazon Elastic Kubernetes Service - - Checks if package gdm is installed. - - - - - - - - - Package grub2 is installed - - Amazon Elastic Kubernetes Service - - Checks if package grub2-common is installed. - - - - - - - - - - - - - Package libuser is installed - - Amazon Elastic Kubernetes Service - - Checks if package libuser is installed. - - - - - - - - - Package providing /etc/login.defs is installed - - Amazon Elastic Kubernetes Service - - Checks if package providing /etc/login.defs and is installed. - - - - - - - - - Package net-snmp is installed - - Amazon Elastic Kubernetes Service - - Checks if package net-snmp is installed. - - - - - - - - - Check if the system doesn't act as an oVirt host or manager - - Amazon Elastic Kubernetes Service - - Check if the system has neither ovirt-host nor ovirt-engine installed. - - - - - - - - Package nss-pam-ldapd is installed - - Amazon Elastic Kubernetes Service - - Checks if package nss-pam-ldapd is installed. - - - - - - - - - Package ntp is installed - - Amazon Elastic Kubernetes Service - - Checks if package ntp is installed. - - - - - - - - - Check if the system acts as an oVirt host or manager - - Amazon Elastic Kubernetes Service - - Check if the system has ovirt-host or ovirt-engine installed - - - - - - - - - - Package pam is installed - - Amazon Elastic Kubernetes Service - - Checks if package pam is installed. - - - - - - - - - Package polkit is installed - - Amazon Elastic Kubernetes Service - - Checks if package polkit is installed. - - - - - - - - - Package postfix is installed - - Amazon Elastic Kubernetes Service - - Checks if package postfix is installed. - - - - - - - - - Package sssd-common is installed - - Amazon Elastic Kubernetes Service - - Checks if package sssd-common is installed. - - - - - - - - - Package sudo is installed - - Amazon Elastic Kubernetes Service - - Checks if package sudo is installed. - - - - - - - - - Package systemd is installed - - Amazon Elastic Kubernetes Service - - Checks if package systemd is installed. - - - - - - - - - Package tftp-server is installed - - Amazon Elastic Kubernetes Service - - Checks if package tftp-server is installed. - - - - - - - - - Package tmux is installed - - Amazon Elastic Kubernetes Service - - Checks if package tmux is installed. - - - - - - - - - Package usbguard is installed - - Amazon Elastic Kubernetes Service - - Checks if package usbguard is installed. - - - - - - - - - WiFi interface is present - - Amazon Elastic Kubernetes Service - - Checks if any wifi interface is present. - - - - - - - - - Package yum is installed - - Amazon Elastic Kubernetes Service - - Checks if package yum is installed. - - - - - - - - - System uses zIPL - - Amazon Elastic Kubernetes Service - - Checks if system uses zIPL bootloader. - - - - - - - - - Check if the scan target is a container - - Amazon Elastic Kubernetes Service - - Check for presence of files characterizing container filesystems. - - - - - - - - - - Check if the scan target is a machine - - Amazon Elastic Kubernetes Service - - Check for absence of files characterizing container filesystems. - - - - - - - - - Kerberos server is older than 1.17-18 - - Amazon Elastic Kubernetes Service - - - Check if version of Kerberos server is lesser than 1.17-18 - - - - - - - - - Kerberos workstation is older than 1.17-18 - - Amazon Elastic Kubernetes Service - - - Check if version of Kerberos workstation is lesser than 1.17-18 - - - - - - - - - Test that the architecture is aarch64 - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64 - - - - - - - - Test for different architecture than aarch64 - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64 - - - - - - - - Test for different architecture than s390x - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x - - - - - - - - Test that the architecture is ppc64le - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is ppc64le - - - - - - - - Test that the architecture is s390x - - Amazon Elastic Kubernetes Service - - Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x - - - - - - - - SSSD is configured to use LDAP - - Amazon Elastic Kubernetes Service - - Identification provider is not set to ad within /etc/sssd/sssd.conf - - - - - - - - - Non-UEFI system boot mode check - - Amazon Elastic Kubernetes Service - - Check if System boot mode is non-UEFI. - - - - - - - - - UEFI system boot mode check - - Amazon Elastic Kubernetes Service - - Check if system boot mode is UEFI. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - alinux-release - - - alinux-release - - - centos-release - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/debian_version - - - /etc/debian_version - ^10.[0-9]+$ - 1 - - - /etc/debian_version - ^11.[0-9]+$ - 1 - - - /etc/debian_version - ^9.[0-9]+$ - 1 - - - fedora-release.* - - - /etc/system-release-cpe - ^cpe:\/o:fedoraproject:fedora:[\d]+$ - 1 - - - oraclelinux-release - - - oraclelinux-release - - - oraclelinux-release - - - openSUSE-release - - - openSUSE-release - - - openSUSE-release - - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)\.\d+"$ - 1 - - - - redhat-release-client - - - redhat-release-workstation - - - redhat-release-server - - - redhat-release-computenode - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - redhat-release-virtualization-host - - - sl-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - /etc/lsb-release - - - /etc/lsb-release - ^DISTRIB_ID=Ubuntu$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=xenial$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=bionic$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=focal$ - 1 - - - uos-release - - - - - - - .gitVersion - - - /var/lib/kubelet/kubeconfig - - - rhvm-appliance - - - audit - - - chrony - - - gdm - - - grub2-common - - - /sys/firmware/opal - - - libuser - - - shadow-utils - - - net-snmp - - - nss-pam-ldapd - - - ntp - - - ovirt-host - - - ovirt-engine - - - pam - - - polkit - - - postfix - - - sssd-common - - - sudo - - - systemd - - - tftp-server - - - tmux - - - usbguard - - - /proc/net/wireless - - - yum - - - s390utils-base - - - /.dockerenv - - - /run/.containerenv - - - krb5-server - - - krb5-workstation - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /etc/sssd/sssd.conf - ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$ - 1 - - - /sys/firmware/efi - - - - - - - ^2.*$ - - - ^3.*$ - - - ^7.*$ - - - centos - - - 8 - - - centos - - - 9 - - - ^7.*$ - - - ^8.*$ - - - ^9.*$ - - - openSUSE-release - - - ^15.*$ - - - ^42.*$ - - - unix - - - rhcos - - - 4 - - - unix - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - 7 - - - unix - - - ^8.*$ - - - ^8.0*$ - - - ^8.1*$ - - - ^8.2*$ - - - ^8.3*$ - - - ^8.4*$ - - - ^8.5*$ - - - ^8.6*$ - - - ^8.7*$ - - - ^8.8*$ - - - ^8.9*$ - - - ^8.10*$ - - - 8 - - - unix - - - ^9.*$ - - - 9 - - - 0:4.4 - - - ^7.*$ - - - unix - - - ^12.*$ - - - ^12.*$ - - - ^12.*$ - - - unix - - - ^15.*$ - - - ^15.*$ - - - ^15.*$ - - - ^20.*$ - - - - ^.*-eks-.*$ - - - - - ^v1\.21\..* - - - - ^4.*$ - - - 0:1.17-18 - - - 0:1.17-18 - - - ^aarch64$ - - - ^ppc64le$ - - - ^s390x$ - - - ppc64le - - - - - /kubernetes-api-resources/version - - - - - diff --git a/images/testcontent/kubelet_default/ssg-ocp4-ds.xml b/images/testcontent/kubelet_default/ssg-ocp4-ds.xml index a87158690..a09ae7a75 100644 --- a/images/testcontent/kubelet_default/ssg-ocp4-ds.xml +++ b/images/testcontent/kubelet_default/ssg-ocp4-ds.xml @@ -1,6 +1,6 @@ - - + + @@ -9,7 +9,7 @@ - + @@ -22,7 +22,7 @@ - + System architecture is not S390X @@ -130,9 +130,9 @@ - - - draft + + + draft Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4 This guide presents a catalog of security-relevant configuration settings for Red Hat OpenShift Container Platform 4. It is a rendering of @@ -193,9 +193,10 @@ respective companies. - - + + + @@ -207,10 +208,11 @@ respective companies. - + + @@ -246,6 +248,11 @@ respective companies. + + + + + @@ -292,7 +299,7 @@ respective companies. - 0.1.64 + 0.1.65 SCAP Security Guide Project SCAP Security Guide Project @@ -412,6 +419,7 @@ respective companies. Joseph Lenox <joseph.lenox@collins.com> Jan Lieskovsky <jlieskov@redhat.com> Markus Linnala <Markus.Linnala@knowit.fi> + Flos Lonicerae <lonicerae@gmail.com> Šimon Lukašík <slukasik@redhat.com> Milan Lysonek <mlysonek@redhat.com> Fredrik Lysén <fredrik@pipemore.se> @@ -637,32 +645,30 @@ This profile is applicable to OpenShift versions 4.6 and greater. - - - + + + + + + - - - - + + - - - - - - - + + + + @@ -756,11 +762,31 @@ This profile is applicable to OpenShift versions 4.6 and greater. + + + + + + + + + + + + + + + + + + + + @@ -781,21 +807,21 @@ This profile is applicable to OpenShift versions 4.6 and greater. - + - - - - + + - - + + + + @@ -822,29 +848,29 @@ https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-work - + + + + + - - - - + + - - - - - - + + + + @@ -970,34 +996,32 @@ consensus and release processes. - - - + + + + + + - - - - + - - - - - - + + + + @@ -1113,7 +1137,7 @@ consensus and release processes. - + @@ -1123,11 +1147,31 @@ consensus and release processes. + + + + + + + + + + + + + + + + + + + + @@ -1162,180 +1206,24 @@ consensus and release processes. - - - - - + - - - - - NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level - This compliance profile reflects the core set of Moderate-Impact Baseline -configuration settings for deployment of Red Hat OpenShift Container -Platform into U.S. Defense, Intelligence, and Civilian agencies. -Development partners and sponsors include the U.S. National Institute -of Standards and Technology (NIST), U.S. Department of Defense, -the National Security Agency, and Red Hat. - -This baseline implements configuration requirements from the following -sources: - -- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53) - -For any differing configuration requirements, e.g. password lengths, the stricter -security setting was chosen. Security Requirement Traceability Guides (RTMs) and -sample System Security Configuration Guides are provided via the -scap-security-guide-docs package. - -This profile reflects U.S. Government consensus content and is developed through -the ComplianceAsCode initiative, championed by the National -Security Agency. Except for differences in formatting to accommodate -publishing processes, this profile mirrors ComplianceAsCode -content as minor divergences, such as bugfixes, work through the -consensus and release processes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level + + NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level This compliance profile reflects the core set of Moderate-Impact Baseline configuration settings for deployment of Red Hat OpenShift Container Platform into U.S. Defense, Intelligence, and Civilian agencies. @@ -1359,164 +1247,6 @@ Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes. - https://nvd.nist.gov/800-53/Rev4/impact/moderate - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Node level - This compliance profile reflects a set of security recommendations for -the usage of Red Hat OpenShift Container Platform in critical -infrastructure in the energy sector. This follows the recommendations -coming from the following CIP standards: - -- CIP-002-5 -- CIP-003-8 -- CIP-004-6 -- CIP-005-6 -- CIP-007-3 -- CIP-007-6 -- CIP-009-6 - https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx @@ -1611,34 +1341,32 @@ coming from the following CIP standards: - - - + + + + + + - - - - + - - - - - - + + + + @@ -1648,21 +1376,32 @@ coming from the following CIP standards: - - North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Platform level - This compliance profile reflects a set of security recommendations for -the usage of Red Hat OpenShift Container Platform in critical -infrastructure in the energy sector. This follows the recommendations -coming from the following CIP standards: + + NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level + This compliance profile reflects the core set of Moderate-Impact Baseline +configuration settings for deployment of Red Hat OpenShift Container +Platform into U.S. Defense, Intelligence, and Civilian agencies. +Development partners and sponsors include the U.S. National Institute +of Standards and Technology (NIST), U.S. Department of Defense, +the National Security Agency, and Red Hat. -- CIP-002-5 -- CIP-003-8 -- CIP-004-6 -- CIP-005-6 -- CIP-007-3 -- CIP-007-6 -- CIP-009-6 - https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx +This baseline implements configuration requirements from the following +sources: + +- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53) + +For any differing configuration requirements, e.g. password lengths, the stricter +security setting was chosen. Security Requirement Traceability Guides (RTMs) and +sample System Security Configuration Guides are provided via the +scap-security-guide-docs package. + +This profile reflects U.S. Government consensus content and is developed through +the ComplianceAsCode initiative, championed by the National +Security Agency. Except for differences in formatting to accommodate +publishing processes, this profile mirrors ComplianceAsCode +content as minor divergences, such as bugfixes, work through the +consensus and release processes. + https://nvd.nist.gov/800-53/Rev4/impact/moderate @@ -1741,7 +1480,7 @@ coming from the following CIP standards: - + @@ -1750,11 +1489,31 @@ coming from the following CIP standards: + + + + + + + + + + + + + + + + + + + + @@ -1789,27 +1548,41 @@ coming from the following CIP standards: - - - - - + + + + + - - PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4 - Ensures PCI-DSS v3.2.1 security configuration settings are applied. - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf + + North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Node level + This compliance profile reflects a set of security recommendations for +the usage of Red Hat OpenShift Container Platform in critical +infrastructure in the energy sector. This follows the recommendations +coming from the following CIP standards: + +- CIP-002-5 +- CIP-003-8 +- CIP-004-6 +- CIP-005-6 +- CIP-007-3 +- CIP-007-6 +- CIP-009-6 + https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx + + + @@ -1879,6 +1652,7 @@ coming from the following CIP standards: + @@ -1899,45 +1673,56 @@ coming from the following CIP standards: - - - + + + + + + + - - - - + - - - - - - - + + + + + + - - PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4 - Ensures PCI-DSS v3.2.1 security configuration settings are applied. - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf + + North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Platform level + This compliance profile reflects a set of security recommendations for +the usage of Red Hat OpenShift Container Platform in critical +infrastructure in the energy sector. This follows the recommendations +coming from the following CIP standards: + +- CIP-002-5 +- CIP-003-8 +- CIP-004-6 +- CIP-005-6 +- CIP-007-3 +- CIP-007-6 +- CIP-009-6 + https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx @@ -1984,8 +1769,15 @@ coming from the following CIP standards: + + + + + + + @@ -1995,9 +1787,9 @@ coming from the following CIP standards: + - @@ -2009,31 +1801,62 @@ coming from the following CIP standards: + + + + + + + - + + + + + + + + + + + + + + + + + + + + - + - + + + + + + @@ -2046,34 +1869,27 @@ coming from the following CIP standards: - - - - - - - + - + + + + + + - - [DRAFT] DISA STIG for Red Hat OpenShift Container Platform 4 - Node level - This is a draft profile for experimental purposes. It is not based on the -DISA STIG for OCP4, because one was not available at the time yet. This -profile contains configuration checks that align to the DISA STIG for -Red Hat OpenShift Container Platform 4. - https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Container_Platform_V1R3_SRG.zip + + PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4 + Ensures PCI-DSS v3.2.1 security configuration settings are applied. + https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - - - @@ -2131,6 +1947,9 @@ Red Hat OpenShift Container Platform 4. + + + @@ -2140,7 +1959,6 @@ Red Hat OpenShift Container Platform 4. - @@ -2154,60 +1972,50 @@ Red Hat OpenShift Container Platform 4. + + + - - - - - - - - - - - + + + + + + - - - - + + - - - - - - + + + + - - - [DRAFT] DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level - This is a draft profile for experimental purposes. It is not based on the -DISA STIG for OCP4, because one was not available at the time yet. This -profile contains configuration checks that align to the DISA STIG for -Red Hat OpenShift Container Platform 4. - https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Container_Platform_V1R3_SRG.zip + + PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4 + Ensures PCI-DSS v3.2.1 security configuration settings are applied. + https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf @@ -2254,12 +2062,8 @@ Red Hat OpenShift Container Platform 4. - - - - @@ -2271,6 +2075,7 @@ Red Hat OpenShift Container Platform 4. + @@ -2279,9 +2084,9 @@ Red Hat OpenShift Container Platform 4. + - @@ -2289,27 +2094,44 @@ Red Hat OpenShift Container Platform 4. + + + + + - - + + + + + + + + + + + + + + + + - - + + - - @@ -2322,20 +2144,22 @@ Red Hat OpenShift Container Platform 4. - + + - - - - + - + + + + + Introduction @@ -2666,19 +2490,27 @@ AWS resources will be able, through IAM policies, to use the KMS key to eventual - - Ensure that the cluster was installed with FIPS mode enabled + + Ensure that FIPS mode is enabled on all cluster nodes OpenShift has an installation-time flag that can enable FIPS mode for the cluster. The flag fips: true must be enabled at install time in the install-config.yaml file. This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/machineconfiguration.openshift.io/v1/machineconfigs/99-master-fips API endpoint to the local /apis/machineconfiguration.openshift.io/v1/machineconfigs/99-master-fips file. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/machineconfiguration.openshift.io/v1/machineconfigs + API endpoint, filter with with the jq utility using the following filter + [.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.fips == true) + and persist it to the local + /apis/machineconfiguration.openshift.io/v1/machineconfigs#ab7e02a1c3f44ae48f843ce3dee7b948d624d2f702b9428760efbfd4653847ba + file. + CIP-003-8 R4.2 CIP-007-3 R5.1 CIP-007-3 R7.1 AC-17(2) SC-13 IA-7 + Req-3.4.1 SRG-APP-000014-CTR-000035 SRG-APP-000014-CTR-000040 SRG-APP-000416-CTR-001015 @@ -2690,34 +2522,6 @@ Therefore, you need to use a tool that can query the OCP API, retrieve the Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested -and validated. - CCE-84214-6 - - - - - - - - - - Ensure that FIPS mode is enabled on all cluster nodes - OpenShift has an installation-time flag that can enable FIPS mode -for the cluster. The flag fips: true must be enabled -at install time in the install-config.yaml file. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/machineconfiguration.openshift.io/v1/machineconfigs - API endpoint, filter with with the jq utility using the following filter - [.items[] | select(.metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|map(.spec.fips == true) - and persist it to the local - /apis/machineconfiguration.openshift.io/v1/machineconfigs#191c7889a801949fcc07c8f067ca719c614388ea53f4b96b7148c57799e423b3 - file. - - Req-3.4.1 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested and validated. CCE-85860-5 @@ -2765,11 +2569,11 @@ at installation. The object luks must be present at install prepared with the install-config.yaml file. This rule's check operates on the cluster configuration dump. Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/machineconfiguration.openshift.io/v1/machineconfigs +/apis/machineconfiguration.openshift.io/v1/machineconfigs API endpoint, filter with with the jq utility using the following filter - [.items[] | select(.metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|map(.spec.config.storage.luks[0].clevis != null) + [.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null) and persist it to the local - /apis/machineconfiguration.openshift.io/v1/machineconfigs#136fe907b51dc9ea5011707799731b533561dab4b043f086f36c0b5c9c288414 + /apis/machineconfiguration.openshift.io/v1/machineconfigs#9fab597988075d76a1c081cdc533f05623251a854b9936a08ae52cca5fc5a311 file. Req-3.4.1 @@ -2797,17 +2601,17 @@ disk encryption can be used as well. [1][2] [2] https://docs.openshift.com/container-platform/latest/machine_management/creating_machinesets/creating-machineset-gcp.html#machineset-enabling-customer-managed-encryption_creating-machineset-gcp This rule's check operates on the cluster configuration dump. Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/machineconfiguration.openshift.io/v1/machineconfigs +/apis/machineconfiguration.openshift.io/v1/machineconfigs API endpoint, filter with with the jq utility using the following filter - [.items[] | select(.metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|map(.spec.fips == true) + [.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.fips == true) and persist it to the local - /apis/machineconfiguration.openshift.io/v1/machineconfigs#191c7889a801949fcc07c8f067ca719c614388ea53f4b96b7148c57799e423b3 + /apis/machineconfiguration.openshift.io/v1/machineconfigs#ab7e02a1c3f44ae48f843ce3dee7b948d624d2f702b9428760efbfd4653847ba file. - /apis/machineconfiguration.openshift.io/v1/machineconfigs + /apis/machineconfiguration.openshift.io/v1/machineconfigs API endpoint, filter with with the jq utility using the following filter - [.items[] | select(.metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|map(.spec.config.storage.luks[0].clevis != null) + [.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null) and persist it to the local - /apis/machineconfiguration.openshift.io/v1/machineconfigs#136fe907b51dc9ea5011707799731b533561dab4b043f086f36c0b5c9c288414 + /apis/machineconfiguration.openshift.io/v1/machineconfigs#9fab597988075d76a1c081cdc533f05623251a854b9936a08ae52cca5fc5a311 file. /apis/machine.openshift.io/v1beta1/machinesets?limit=500 API endpoint, filter with with the jq utility using the following filter @@ -3528,7 +3332,7 @@ In a large multi-tenant cluster, there might be a small percentage of misbehaving tenants which could have a significant impact on the performance of the cluster overall. It is recommended to limit the rate of events that the API Server will accept. - + CCE-86390-2 @@ -3864,6 +3668,7 @@ the internal service. The value is set by the bindAddress argument under the se parameter. CCE-83646-0 + @@ -4091,8 +3896,8 @@ requires the API Server to identify itself to the etcd server using a SSL Certificate Authority file. CCE-84216-1 - + @@ -4437,7 +4242,7 @@ Therefore, you need to use a tool that can query the OCP API, retrieve the follo HTTPS endpoints. Requests from the API Server are treated anonymously. Configuring certificate-based kubelet authentication ensures that the API Server authenticates itself to kubelets when submitting requests. - + CCE-84080-1 @@ -4526,7 +4331,7 @@ Therefore, you need to use a tool that can query the OCP API, retrieve the follo HTTPS endpoints. Requests from the API Server are treated anonymously. Configuring certificate-based kubelet authentication ensures that the API Server authenticates itself to kubelets when submitting requests. - + CCE-83591-8 @@ -5163,8 +4968,8 @@ old log files to keep as 10, there would be approximately 1 GB of log data available for use in analysis. CCE-83687-4 - + @@ -5179,6 +4984,12 @@ to multiple authentication services. Some of these authentication methods by not be secure or common methodologies, or they may not be secure by default. This section introduces mechanisms for configuring authentication systems Kubernetes. + + OAuth Clients Token Inactivity Timeout + Enter OAuth Clients Token Inactivity Timeout in Seconds + 600 + 600 + OAuth Token Inactivity Timeout Enter OAuth Token Inactivity Timeout @@ -5420,6 +5231,7 @@ spec: + @@ -5587,7 +5399,7 @@ of opportunity for unauthorized personnel to take control of a session that has been left unattended. CCE-84178-3 - + @@ -7388,7 +7200,7 @@ The kubelet takes a set of PodSpecs that are provided through various mechanisms and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn’t manage containers which were not created by Kubernetes. - + Configure Kubelet Event Limit Maximum event creations per second. 5 @@ -7493,18 +7305,22 @@ created by Kubernetes. Configure Kubelet use of the Strong Cryptographic Ciphers Cryptographic Ciphers Available for Kubelet, seperated by comma - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Configure Kubelet use of the Strong Cryptographic Ciphers Cryptographic Ciphers Available for Kubelet - ^(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)$ + ^(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256)$ + + + Configure which node to scan based on role + Configure which node to scan based on role + master - + Configure which node to scan based on role Configure which node to scan based on role worker - master Streaming Connection Timeout Options @@ -7514,13 +7330,13 @@ and (h) for hours. 5m0s 10m0s 30m0s - 1h - 2h - 4h - 6h - 8h + 1h0m0s + 2h0m0s + 4h0m0s + 6h0m0s + 8h0m0s - + Disable Anonymous Authentication to the Kubelet By default, anonymous access to the Kubelet server is enabled. This configuration check ensures that anonymous requests to the Kubelet @@ -7534,6 +7350,8 @@ authentication: enabled: false ... + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -7548,16 +7366,131 @@ authentication methods are treated as anonymous requests. These requests are then served by the Kubelet server. OpenShift Operators should rely on authentication to authorize access and disallow anonymous requests. - + CCE-83815-1 + + + + + + + + + + + Disable Anonymous Authentication to the Kubelet + By default, anonymous access to the Kubelet server is enabled. This +configuration check ensures that anonymous requests to the Kubelet +server are disabled. Edit the Kubelet server configuration file +/etc/kubernetes/kubelet.conf on the kubelet node(s) +and set the below parameter: + +authentication: + ... + anonymous: + enabled: false + ... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.1 + When enabled, requests that are not rejected by other configured +authentication methods are treated as anonymous requests. These +requests are then served by the Kubelet server. OpenShift Operators should +rely on authentication to authorize access and disallow anonymous +requests. + + + + + + + + + + Disable Anonymous Authentication to the Kubelet + By default, anonymous access to the Kubelet server is enabled. This +configuration check ensures that anonymous requests to the Kubelet +server are disabled. Edit the Kubelet server configuration file +/etc/kubernetes/kubelet.conf on the kubelet node(s) +and set the below parameter: + +authentication: + ... + anonymous: + enabled: false + ... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.1 + When enabled, requests that are not rejected by other configured +authentication methods are treated as anonymous requests. These +requests are then served by the Kubelet server. OpenShift Operators should +rely on authentication to authorize access and disallow anonymous +requests. + + + + + + + + + + + + Disable Anonymous Authentication to the Kubelet + By default, anonymous access to the Kubelet server is enabled. This +configuration check ensures that anonymous requests to the Kubelet +server are disabled. Edit the Kubelet server configuration file +/etc/kubernetes/kubelet.conf on the kubelet node(s) +and set the below parameter: + +authentication: + ... + anonymous: + enabled: false + ... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.1 + When enabled, requests that are not rejected by other configured +authentication methods are treated as anonymous requests. These +requests are then served by the Kubelet server. OpenShift Operators should +rely on authentication to authorize access and disallow anonymous +requests. + + + + - + Ensure authorization is set to Webhook Unauthenticated/unauthorized users should have no access to OpenShift nodes. The Kubelet should be set to only allow Webhook authorization. @@ -7569,6 +7502,8 @@ authorization: mode: Webhook ... + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -7580,15 +7515,231 @@ authorization: 4.2.2 Ensuring that the authorization is configured correctly helps enforce that unauthenticated/unauthorized users have no access to OpenShift nodes. - + CCE-83593-4 + + + + + + + + + + + Ensure authorization is set to Webhook + Unauthenticated/unauthorized users should have no access to OpenShift nodes. +The Kubelet should be set to only allow Webhook authorization. +To ensure that the Kubelet requires authorization, +validate that authorization is configured to Webhook +in /etc/kubernetes/kubelet.conf: + +authorization: + mode: Webhook + ... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.2 + Ensuring that the authorization is configured correctly helps enforce that +unauthenticated/unauthorized users have no access to OpenShift nodes. + + + + + + + + + + Ensure authorization is set to Webhook + Unauthenticated/unauthorized users should have no access to OpenShift nodes. +The Kubelet should be set to only allow Webhook authorization. +To ensure that the Kubelet requires authorization, +validate that authorization is configured to Webhook +in /etc/kubernetes/kubelet.conf: + +authorization: + mode: Webhook + ... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.2 + Ensuring that the authorization is configured correctly helps enforce that +unauthenticated/unauthorized users have no access to OpenShift nodes. + + + + + + + + + + + + Ensure authorization is set to Webhook + Unauthenticated/unauthorized users should have no access to OpenShift nodes. +The Kubelet should be set to only allow Webhook authorization. +To ensure that the Kubelet requires authorization, +validate that authorization is configured to Webhook +in /etc/kubernetes/kubelet.conf: + +authorization: + mode: Webhook + ... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.2 + Ensuring that the authorization is configured correctly helps enforce that +unauthenticated/unauthorized users have no access to OpenShift nodes. + + + + + + kubelet - Configure the Client CA Certificate + By default, the kubelet is not configured with a CA certificate which +can subject the kubelet to man-in-the-middle attacks. + +To configure a client CA certificate, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +authentication: +... + x509: + clientCAFile: /etc/kubernetes/kubelet-ca.crt +... + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.3 + Not having a CA certificate for the kubelet will subject the kubelet to possible +man-in-the-middle attacks especially on unsafe or untrusted networks. +Certificate validation for the kubelet allows the API server to validate +the kubelet's identity. + + CCE-83724-5 + + + + + + + + + + + + kubelet - Configure the Client CA Certificate + By default, the kubelet is not configured with a CA certificate which +can subject the kubelet to man-in-the-middle attacks. + +To configure a client CA certificate, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +authentication: +... + x509: + clientCAFile: /etc/kubernetes/kubelet-ca.crt +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.3 + Not having a CA certificate for the kubelet will subject the kubelet to possible +man-in-the-middle attacks especially on unsafe or untrusted networks. +Certificate validation for the kubelet allows the API server to validate +the kubelet's identity. + + + + + + + + + + kubelet - Configure the Client CA Certificate + By default, the kubelet is not configured with a CA certificate which +can subject the kubelet to man-in-the-middle attacks. + +To configure a client CA certificate, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +authentication: +... + x509: + clientCAFile: /etc/kubernetes/kubelet-ca.crt +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.3 + Not having a CA certificate for the kubelet will subject the kubelet to possible +man-in-the-middle attacks especially on unsafe or untrusted networks. +Certificate validation for the kubelet allows the API server to validate +the kubelet's identity. + + + + + + + + + + kubelet - Configure the Client CA Certificate By default, the kubelet is not configured with a CA certificate which @@ -7617,16 +7768,84 @@ authentication: man-in-the-middle attacks especially on unsafe or untrusted networks. Certificate validation for the kubelet allows the API server to validate the kubelet's identity. - - CCE-83724-5 + + + - + + Kubelet - Ensure Event Creation Is Configured + Security relevant information should be captured. The eventRecordQPS +Kubelet option can be used to limit the rate at which events are gathered. +Setting this too low could result in relevant events not being logged, +however the unlimited setting of 0 could result in a denial of service on +the kubelet. Processing and storage systems should be scaled to handle the +expected event load. To set the eventRecordQPS option for the kubelet, +create a KubeletConfig option along these lines: + +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + name: kubelet-config-$pool +spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + eventRecordQPS: + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.9 + It is important to capture all events and not restrict event creation. +Events are an important source of security information and analytics that +ensure that your environment is consistently monitored using the event +data. + CCE-83576-9 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + eventRecordQPS: {{.var_event_record_qps}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + eventRecordQPS: {{.var_event_record_qps}} + + + + + + + + + + + + + Kubelet - Ensure Event Creation Is Configured Security relevant information should be captured. The eventRecordQPS Kubelet option can be used to limit the rate at which events are gathered. @@ -7665,15 +7884,103 @@ Events are an important source of security information and analytics that ensure that your environment is consistently monitored using the event data. - CCE-83576-9 - --- + + + + + + + + + Kubelet - Ensure Event Creation Is Configured + Security relevant information should be captured. The eventRecordQPS +Kubelet option can be used to limit the rate at which events are gathered. +Setting this too low could result in relevant events not being logged, +however the unlimited setting of 0 could result in a denial of service on +the kubelet. Processing and storage systems should be scaled to handle the +expected event load. To set the eventRecordQPS option for the kubelet, +create a KubeletConfig option along these lines: + apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + name: kubelet-config-$pool spec: - kubeletConfig: - eventRecordQPS: {{.var_event_record_qps}} - + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + eventRecordQPS: + + The MachineConfig Operator does not merge KubeletConfig +objects, the last object is used instead. In case you need to +set multiple options for kubelet, consider putting all the custom +options into a single KubeletConfig object. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.9 + It is important to capture all events and not restrict event creation. +Events are an important source of security information and analytics that +ensure that your environment is consistently monitored using the event +data. + + + + + + + + + + + + Kubelet - Ensure Event Creation Is Configured + Security relevant information should be captured. The eventRecordQPS +Kubelet option can be used to limit the rate at which events are gathered. +Setting this too low could result in relevant events not being logged, +however the unlimited setting of 0 could result in a denial of service on +the kubelet. Processing and storage systems should be scaled to handle the +expected event load. To set the eventRecordQPS option for the kubelet, +create a KubeletConfig option along these lines: + +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + name: kubelet-config-$pool +spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + eventRecordQPS: + + The MachineConfig Operator does not merge KubeletConfig +objects, the last object is used instead. In case you need to +set multiple options for kubelet, consider putting all the custom +options into a single KubeletConfig object. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.9 + It is important to capture all events and not restrict event creation. +Events are an important source of security information and analytics that +ensure that your environment is consistently monitored using the event +data. + + + @@ -7708,7 +8015,7 @@ Therefore, you need to use a tool that can query the OCP API, retrieve the follo 4.2.10 Without cryptographic integrity protections, information can be altered by unauthorized users without detection. - + CCE-83396-2 @@ -7747,6 +8054,125 @@ altered by unauthorized users without detection. + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + Ensure that the Kubelet is configured to only use strong cryptographic ciphers. +To set the cipher suites for the kubelet, create new or modify existing +KubeletConfig object along these lines, one for every +MachineConfigPool: + + apiVersion: machineconfiguration.openshift.io/v1 + kind: KubeletConfig + metadata: + name: kubelet-config-$pool + spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + tlsCipherSuites: + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + +In order to configure this rule to check for an alternative cipher, both var_kubelet_tls_cipher_suites_regex +and var_kubelet_tls_cipher_suites have to be set + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.13 + TLS ciphers have had a number of known vulnerabilities and weaknesses, +which can reduce the protection provided by them. By default Kubernetes +supports a number of TLS ciphersuites including some that have security +concerns, weakening the protection provided. + + CCE-86030-4 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + tlsCipherSuites: [{{.var_kubelet_tls_cipher_suites}}] +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + tlsCipherSuites: [{{.var_kubelet_tls_cipher_suites}}] + + + + + + + + + + + + + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + Ensure that the Kubelet is configured to only use strong cryptographic ciphers. +To set the cipher suites for the kubelet, create new or modify existing +KubeletConfig object along these lines, one for every +MachineConfigPool: + + apiVersion: machineconfiguration.openshift.io/v1 + kind: KubeletConfig + metadata: + name: kubelet-config-$pool + spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + tlsCipherSuites: + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + +In order to configure this rule to check for an alternative cipher, both var_kubelet_tls_cipher_suites_regex +and var_kubelet_tls_cipher_suites have to be set + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.13 + TLS ciphers have had a number of known vulnerabilities and weaknesses, +which can reduce the protection provided by them. By default Kubernetes +supports a number of TLS ciphersuites including some that have security +concerns, weakening the protection provided. + + + + + + + + + Ensure that the Ingress Controller only makes use of Strong Cryptographic Ciphers Ensure that the Ingress Controller is configured to only use strong cryptographic ciphers. @@ -7817,6 +8243,56 @@ spec: + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + Ensure that the Kubelet is configured to only use strong cryptographic ciphers. +To set the cipher suites for the kubelet, create new or modify existing +KubeletConfig object along these lines, one for every +MachineConfigPool: + + apiVersion: machineconfiguration.openshift.io/v1 + kind: KubeletConfig + metadata: + name: kubelet-config-$pool + spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + tlsCipherSuites: + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + +In order to configure this rule to check for an alternative cipher, both var_kubelet_tls_cipher_suites_regex +and var_kubelet_tls_cipher_suites have to be set + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.13 + TLS ciphers have had a number of known vulnerabilities and weaknesses, +which can reduce the protection provided by them. By default Kubernetes +supports a number of TLS ciphersuites including some that have security +concerns, weakening the protection provided. + + + + + + + + + + + Ensure that the OpenShift API Server Operator only makes use of Strong Cryptographic Ciphers Ensure that the OpenShift API Server Operator is configured to only use strong cryptographic ciphers. @@ -7873,6 +8349,8 @@ To set the cipher suites for the kubelet, create new or modify existing - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 In order to configure this rule to check for an alternative cipher, both var_kubelet_tls_cipher_suites_regex and var_kubelet_tls_cipher_suites have to be set @@ -7889,17 +8367,11 @@ and var_kubelet_tls_cipher_suites have to be set which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided. - - --- -# {{.var_kubelet_tls_cipher_suites_regex}} we have to put variable array name here for mutilines remediation -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - tlsCipherSuites: [{{.var_kubelet_tls_cipher_suites}}] - + + + @@ -7934,7 +8406,7 @@ Therefore, you need to use a tool that can query the OCP API, retrieve the follo 4.2.10 Without cryptographic integrity protections, information can be altered by unauthorized users without detection. - + CCE-90614-9 @@ -7993,9 +8465,78 @@ and validation. However, in some cases explicit overriding this parameter is necessary to ensure that the appropriate node name stays as it is in case of certain upgrade conditions. e.g. as is the case in AWS and OpenStack when migrating +to external cloud providers. + + + + kubelet - Hostname Override handling + Normally, OpenShift lets the kubelet get the hostname from either the +cloud provider itself, or from the node's hostname. This ensures that +the PKI allocated by the deployment uses the appropriate values, is valid +and keeps working throughout the lifecycle of the cluster. IP addresses +are not used, and hence this makes it easier for security analysts to +associate kubelet logs with the appropriate node. + CIP-003-3 R6 + CIP-004-3 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + 4.2.8 + Allowing hostnames to be overridden creates issues around resolving nodes +in addition to TLS configuration, certificate validation, and log correlation +and validation. +However, in some cases explicit overriding this parameter is +necessary to ensure that the appropriate node name stays as it is in case of +certain upgrade conditions. e.g. as is the case in AWS and OpenStack when migrating to external cloud providers. + + kubelet - Hostname Override handling + Normally, OpenShift lets the kubelet get the hostname from either the +cloud provider itself, or from the node's hostname. This ensures that +the PKI allocated by the deployment uses the appropriate values, is valid +and keeps working throughout the lifecycle of the cluster. IP addresses +are not used, and hence this makes it easier for security analysts to +associate kubelet logs with the appropriate node. + CIP-003-3 R6 + CIP-004-3 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + 4.2.8 + Allowing hostnames to be overridden creates issues around resolving nodes +in addition to TLS configuration, certificate validation, and log correlation +and validation. +However, in some cases explicit overriding this parameter is +necessary to ensure that the appropriate node name stays as it is in case of +certain upgrade conditions. e.g. as is the case in AWS and OpenStack when migrating +to external cloud providers. + + + + kubelet - Hostname Override handling + Normally, OpenShift lets the kubelet get the hostname from either the +cloud provider itself, or from the node's hostname. This ensures that +the PKI allocated by the deployment uses the appropriate values, is valid +and keeps working throughout the lifecycle of the cluster. IP addresses +are not used, and hence this makes it easier for security analysts to +associate kubelet logs with the appropriate node. + CIP-003-3 R6 + CIP-004-3 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + 4.2.8 + Allowing hostnames to be overridden creates issues around resolving nodes +in addition to TLS configuration, certificate validation, and log correlation +and validation. +However, in some cases explicit overriding this parameter is +necessary to ensure that the appropriate node name stays as it is in case of +certain upgrade conditions. e.g. as is the case in AWS and OpenStack when migrating +to external cloud providers. + + kubelet - Disable the Read-Only Port To disable the read-only port, edit the kubelet configuration @@ -8041,7 +8582,7 @@ system. - + kubelet - Enable Certificate Rotation To enable the kubelet to rotate client certificates, edit the kubelet configuration file /etc/kubernetes/kubelet.conf @@ -8051,6 +8592,8 @@ on the kubelet node(s) and set the below parameter: rotateCertificates: true ... + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -8062,9 +8605,103 @@ rotateCertificates: true 4.2.11 Allowing the kubelet to auto-update the certificates ensure that there is no downtime in certificate renewal as well as ensures confidentiality and integrity. - + CCE-83838-3 + + + + + + + + + + + kubelet - Enable Certificate Rotation + To enable the kubelet to rotate client certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +... +rotateCertificates: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.11 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + + + + + + + kubelet - Enable Certificate Rotation + To enable the kubelet to rotate client certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +... +rotateCertificates: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.11 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + + + + + + + + + kubelet - Enable Certificate Rotation + To enable the kubelet to rotate client certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +... +rotateCertificates: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.11 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + @@ -8082,6 +8719,8 @@ featureGates: RotateKubeletClientCertificate: true ... + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -8093,15 +8732,81 @@ featureGates: 4.2.11 Allowing the kubelet to auto-update the certificates ensure that there is no downtime in certificate renewal as well as ensures confidentiality and integrity. - + CCE-83352-5 + + + + kubelet - Enable Client Certificate Rotation + To enable the kubelet to rotate client certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +featureGates: +... + RotateKubeletClientCertificate: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.11 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + + + + + + + + + kubelet - Enable Client Certificate Rotation + To enable the kubelet to rotate client certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +featureGates: +... + RotateKubeletClientCertificate: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.11 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + + + + + + + kubelet - Allow Automatic Firewall Configuration The kubelet has the ability to automatically configure the firewall to allow @@ -8111,6 +8816,8 @@ To allow the kubelet to modify the firewall, edit the kubelet configuration file /etc/kubernetes/kubelet.conf on the kubelet node(s) and set the below parameter: makeIPTablesUtilChains: true + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -8124,21 +8831,152 @@ on the kubelet node(s) and set the below parameter: networking traffic through. This ensures that when a pod or container is running that the correct ports are configured as well as removing the ports when a pod or container is no longer in existence. - + CCE-83775-7 --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" spec: kubeletConfig: makeIPTablesUtilChains: true - - - - - - - +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + makeIPTablesUtilChains: true + + + + + + + + + + + + + kubelet - Allow Automatic Firewall Configuration + The kubelet has the ability to automatically configure the firewall to allow +the containers required ports and connections to networking resources and destinations +parameters potentially creating a security incident. +To allow the kubelet to modify the firewall, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: +makeIPTablesUtilChains: true + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.7 + The kubelet should automatically configure the firewall settings to allow access and +networking traffic through. This ensures that when a pod or container is running that +the correct ports are configured as well as removing the ports when a pod or +container is no longer in existence. + + + + + + + + + + kubelet - Allow Automatic Firewall Configuration + The kubelet has the ability to automatically configure the firewall to allow +the containers required ports and connections to networking resources and destinations +parameters potentially creating a security incident. +To allow the kubelet to modify the firewall, edit the kubelet configuration +To set the makeIPTablesUtilChains option for the kubelet, +create a KubeletConfig option along these lines: + +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + name: kubelet-config-$pool +spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + makeIPTablesUtilChains: true + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.7 + The kubelet should automatically configure the firewall settings to allow access and +networking traffic through. This ensures that when a pod or container is running that +the correct ports are configured as well as removing the ports when a pod or +container is no longer in existence. + + + + + + + + + + + + kubelet - Allow Automatic Firewall Configuration + The kubelet has the ability to automatically configure the firewall to allow +the containers required ports and connections to networking resources and destinations +parameters potentially creating a security incident. +To allow the kubelet to modify the firewall, edit the kubelet configuration +To set the makeIPTablesUtilChains option for the kubelet, +create a KubeletConfig option along these lines: + +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + name: kubelet-config-$pool +spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + makeIPTablesUtilChains: true + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.7 + The kubelet should automatically configure the firewall settings to allow access and +networking traffic through. This ensures that when a pod or container is running that +the correct ports are configured as well as removing the ports when a pod or +container is no longer in existence. + + + + + + + + + kubelet - Enable Protect Kernel Defaults @@ -8854,7 +9692,7 @@ kernel behavior. - + kubelet - Enable Server Certificate Rotation To enable the kubelet to rotate server certificates, edit the kubelet configuration file /etc/kubernetes/kubelet.conf @@ -8865,6 +9703,8 @@ featureGates: RotateKubeletServerCertificate: true ... + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -8876,16 +9716,178 @@ featureGates: 4.2.12 Allowing the kubelet to auto-update the certificates ensure that there is no downtime in certificate renewal as well as ensures confidentiality and integrity. - + CCE-83356-6 + + + + + + + + + + + kubelet - Enable Server Certificate Rotation + To enable the kubelet to rotate server certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +featureGates: +... + RotateKubeletServerCertificate: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.12 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + + + + + + + kubelet - Enable Server Certificate Rotation + To enable the kubelet to rotate server certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +featureGates: +... + RotateKubeletServerCertificate: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.12 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + + + + + + + + + kubelet - Enable Server Certificate Rotation + To enable the kubelet to rotate server certificates, edit the kubelet configuration +file /etc/kubernetes/kubelet.conf +on the kubelet node(s) and set the below parameter: + +featureGates: +... + RotateKubeletServerCertificate: true +... + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.12 + Allowing the kubelet to auto-update the certificates ensure that there is no downtime +in certificate renewal as well as ensures confidentiality and integrity. + + + + - + + kubelet - Do Not Disable Streaming Timeouts + Timouts for streaming connections should not be disabled as they help to prevent +denial-of-service attacks. +To configure streaming connection timeouts +To set the streamingConnectionIdleTimeout option for the kubelet, +create a KubeletConfig option along these lines: + +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + name: kubelet-config-$pool +spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + streamingConnectionIdleTimeout: + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.5 + Ensuring connections have timeouts helps to protect against denial-of-service attacks as +well as disconnect inactive connections. In addition, setting connections timeouts helps +to prevent from running out of ephemeral ports. + + CCE-84097-5 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + streamingConnectionIdleTimeout: {{.var_streaming_connection_timeouts}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + streamingConnectionIdleTimeout: {{.var_streaming_connection_timeouts}} + + + + + + + + + + + + + kubelet - Do Not Disable Streaming Timeouts Timouts for streaming connections should not be disabled as they help to prevent denial-of-service attacks. @@ -8906,23 +9908,99 @@ on the kubelet node(s) and set the below parameter: well as disconnect inactive connections. In addition, setting connections timeouts helps to prevent from running out of ephemeral ports. - CCE-84097-5 - --- + + + + + + + + + + kubelet - Do Not Disable Streaming Timeouts + Timouts for streaming connections should not be disabled as they help to prevent +denial-of-service attacks. +To configure streaming connection timeouts +To set the streamingConnectionIdleTimeout option for the kubelet, +create a KubeletConfig option along these lines: + apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + name: kubelet-config-$pool spec: - kubeletConfig: - streamingConnectionIdleTimeout: {{.var_streaming_connection_timeouts}} - + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + streamingConnectionIdleTimeout: + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.5 + Ensuring connections have timeouts helps to protect against denial-of-service attacks as +well as disconnect inactive connections. In addition, setting connections timeouts helps +to prevent from running out of ephemeral ports. + + + + + + + + + + + + + kubelet - Do Not Disable Streaming Timeouts + Timouts for streaming connections should not be disabled as they help to prevent +denial-of-service attacks. +To configure streaming connection timeouts +To set the streamingConnectionIdleTimeout option for the kubelet, +create a KubeletConfig option along these lines: + +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + name: kubelet-config-$pool +spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + streamingConnectionIdleTimeout: + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.2.5 + Ensuring connections have timeouts helps to protect against denial-of-service attacks as +well as disconnect inactive connections. In addition, setting connections timeouts helps +to prevent from running out of ephemeral ports. + + + - + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -8954,6 +10032,8 @@ This rule pertains to the imagefs.available setting of th section. + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -8968,11 +10048,13 @@ and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - CCE-84144-5 - --- + --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" spec: kubeletConfig: evictionHard: @@ -8980,19 +10062,45 @@ spec: --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionHard: + imagefs.available: {{.var_kubelet_evictionhard_imagefs_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" spec: kubeletConfig: evictionPressureTransitionPeriod: 0s - + + + + + - + - - Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9019,7 +10127,7 @@ To configure, follow the directions in the documentation -This rule pertains to the imagefs.inodesFree setting of the evictionHard +This rule pertains to the imagefs.available setting of the evictionHard section. @@ -9038,30 +10146,15 @@ system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - CCE-84147-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionHard: - imagefs.inodesFree: {{.var_kubelet_evictionhard_imagefs_inodesfree}} ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionPressureTransitionPeriod: 0s - - + - + - - Ensure Eviction threshold Settings Are Set - evictionHard: memory.available + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9088,7 +10181,7 @@ To configure, follow the directions in the documentation -This rule pertains to the memory.available setting of the evictionHard +This rule pertains to the imagefs.available setting of the evictionHard section. @@ -9106,31 +10199,18 @@ and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - - CCE-84135-3 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionHard: - memory.available: {{.var_kubelet_evictionhard_memory_available}} ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionPressureTransitionPeriod: 0s - - + + + + - + - - Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9154,10 +10234,10 @@ Machine Config Pool using any combination of the following: To configure, follow the directions in -the documentation +the documentation -This rule pertains to the nodefs.available setting of the evictionHard +This rule pertains to the imagefs.available setting of the evictionHard section. @@ -9175,31 +10255,18 @@ and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - - CCE-84138-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionHard: - nodefs.available: {{.var_kubelet_evictionhard_nodefs_available}} ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionPressureTransitionPeriod: 0s - - + + + + - + - - Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9226,10 +10293,12 @@ To configure, follow the directions in the documentation -This rule pertains to the nodefs.inodesFree setting of the evictionHard +This rule pertains to the imagefs.inodesFree setting of the evictionHard section. + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -9244,31 +10313,59 @@ and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - - CCE-84141-1 - --- + CCE-84147-8 + --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" spec: kubeletConfig: evictionHard: - nodefs.inodesFree: {{.var_kubelet_evictionhard_nodefs_inodesfree}} + imagefs.inodesFree: {{.var_kubelet_evictionhard_imagefs_inodesfree}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionHard: + imagefs.inodesFree: {{.var_kubelet_evictionhard_imagefs_inodesfree}} --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" spec: kubeletConfig: evictionPressureTransitionPeriod: 0s - + + + + + - + - - Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9295,7 +10392,7 @@ To configure, follow the directions in the documentation -This rule pertains to the imagefs.available setting of the evictionSoft +This rule pertains to the imagefs.inodesFree setting of the evictionHard section. @@ -9314,37 +10411,15 @@ system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - CCE-84127-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoft: - imagefs.available: {{.var_kubelet_evictionsoft_imagefs_available}} ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoftGracePeriod: - imagefs.available: "1m30s" ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionPressureTransitionPeriod: 0s - - + - + - - Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9371,7 +10446,7 @@ To configure, follow the directions in the documentation -This rule pertains to the imagefs.inodesFree setting of the evictionSoft +This rule pertains to the imagefs.inodesFree setting of the evictionHard section. @@ -9389,38 +10464,18 @@ and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - - CCE-84132-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoft: - imagefs.inodesFree: {{.var_kubelet_evictionsoft_imagefs_inodesfree}} ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoftGracePeriod: - imagefs.inodesFree: "1m30s" ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionPressureTransitionPeriod: 0s - - + + + + - + - - Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9447,7 +10502,7 @@ To configure, follow the directions in the documentation -This rule pertains to the memory.available setting of the evictionSoft +This rule pertains to the imagefs.inodesFree setting of the evictionHard section. @@ -9465,38 +10520,18 @@ and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - - CCE-84222-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoft: - memory.available: {{.var_kubelet_evictionsoft_memory_available}} ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoftGracePeriod: - memory.available: "1m30s" ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionPressureTransitionPeriod: 0s - - + + + + - + - - Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9520,13 +10555,15 @@ Machine Config Pool using any combination of the following: To configure, follow the directions in -the documentation +the documentation -This rule pertains to the nodefs.available setting of the evictionSoft +This rule pertains to the memory.available setting of the evictionHard section. + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -9541,38 +10578,59 @@ and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - - CCE-84119-7 - --- + CCE-84135-3 + --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" spec: kubeletConfig: - evictionSoft: - nodefs.available: {{.var_kubelet_evictionsoft_nodefs_available}} + evictionHard: + memory.available: {{.var_kubelet_evictionhard_memory_available}} --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" spec: kubeletConfig: - evictionSoftGracePeriod: - nodefs.available: "1m30s" + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionHard: + memory.available: {{.var_kubelet_evictionhard_memory_available}} --- apiVersion: machineconfiguration.openshift.io/v1 kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" spec: kubeletConfig: evictionPressureTransitionPeriod: 0s - + + + + + - + - - Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available Two types of garbage collection are performed on an OpenShift Container Platform node: @@ -9599,7 +10657,7 @@ To configure, follow the directions in the documentation -This rule pertains to the nodefs.inodesFree setting of the evictionSoft +This rule pertains to the memory.available setting of the evictionHard section. @@ -9618,1782 +10676,1259 @@ system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. - CCE-84123-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoft: - nodefs.inodesFree: {{.var_kubelet_evictionsoft_nodefs_inodesfree}} ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionSoftGracePeriod: - nodefs.inodesFree: "1m30s" ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -spec: - kubeletConfig: - evictionPressureTransitionPeriod: 0s - - + - + - - kubelet - Ensure that the --read-only-port is secured - Disable the read-only port. + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.inodesFree setting of the evictionHard +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - The Kubelet process provides a read-only API in addition to the main Kubelet API. -Unauthenticated access is provided to this read-only API which could possibly retrieve -potentially sensitive information about the cluster. - - - - - - - - - - KubeletTest - KubeletTest - SC-8 - SC-8(1) - SC-8(2) - 4.2.10 - Test KubeletTest - + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + - + - + - - KubeletTest - KubeletTest - SC-8 - SC-8(1) - SC-8(2) - 4.2.10 - Test KubeletTest - + + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the memory.available setting of the evictionHard +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - - + + - + - + - - - OpenShift - Logging Settings - Contains evaluations for the cluster's logging configuration settings. - - Configure the OpenShift Audit Profile - Audit log profiles define how to log requests that come to the OpenShift -API server, the Kubernetes API server, and the OAuth API server. - Default - Default - WriteRequestBodies - AllRequestBodies - - - Ensure that Audit Log Errors Emit Alerts - -OpenShift audit works at the API server level, logging all requests coming to the server. -However, if API server instance is unable to write errors, an alert must be issued -in order for the organization to take a relevant action. e.g. shutting down that instance. - -Kubernetes by default has metrics that enable one to write such alerts: -apiserver_audit_event_totalapiserver_audit_error_total - -Such an example is shipped in OCP 4.9+ - - -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.available setting of the evictionHard +section. + + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + CCE-84138-7 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig metadata: - name: audit-errors - namespace: openshift-kube-apiserver + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" spec: - groups: - - name: apiserver-audit - rules: - - alert: AuditLogError - annotations: - summary: |- - An API Server instance was unable to write audit logs. This could be - triggered by the node running out of space, or a malicious actor - tampering with the audit logs. - description: An API Server had an error writing to an audit log. - expr: | - sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0 - for: 1m - labels: - severity: warning - - - -For more information, consult the -official Kubernetes documentation. - - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/monitoring.coreos.com/v1/prometheusrules?limit=500 - API endpoint, filter with with the jq utility using the following filter - [.items[].spec.groups[].rules[].expr] - and persist it to the local - /apis/monitoring.coreos.com/v1/prometheusrules?limit=500#72e9ad360bb6bdf4ad9e43217cd0ec9cb90e7c3b08d4fbe0edf087ad899e05a6 - file. - - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AU-5 - SRG-APP-000109-CTR-000215 - When there are errors writing audit logs, security events will not be logged -by that specific API Server instance. Security Incident Response teams use -these audit logs, amongst other artifacts, to determine the impact of -security breaches or events. Without these logs, it becomes very difficult -to assess a situation and do appropriate root cause analysis in such incidents. - CCE-90744-4 - --- -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule + kubeletConfig: + evictionHard: + nodefs.available: {{.var_kubelet_evictionhard_nodefs_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig metadata: - name: audit-errors - namespace: openshift-kube-apiserver + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" spec: - groups: - - name: apiserver-audit - rules: - - alert: AuditLogError - annotations: - summary: |- - An API Server instance was unable to write audit logs. This could be - triggered by the node running out of space, or a malicious actor - tampering with the audit logs. - description: An API Server had an error writing to an audit log. - expr: | - sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0 - for: 1m - labels: - severity: warning + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionHard: + nodefs.available: {{.var_kubelet_evictionhard_nodefs_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s + + + - + - + - - Ensure that Audit Log Forwarding Uses TLS + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + -OpenShift audit works at the API server level, logging all requests coming to the server. -Audit is on by default and the best practice is to ship audit logs off the cluster for retention -using a secure protocol. +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. -The cluster-logging-operator is able to do this with the ClusterLogForwarders resource. -The forementioned resource can be configured to logs to different third party systems. -For more information on this, please reference the official documentation: - - https://docs.openshift.com/container-platform/latest/logging/cluster-logging-external.html +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.available setting of the evictionHard +section. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the . -This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance - API endpoint, filter with with the jq utility using the following filter - try [.spec.outputs[].url] catch [] - and persist it to the local - /apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance#71786452ba18c51ba8ad51472a078619e2e8b52a86cd75087af5aab42400f6c0 - file. - - CIP-003-8 R5.2 - CIP-004-6 R3.3 - CIP-007-3 R6.5 - AU-9 - AU-9(2) - AU-9(3) - AU-10 - SRG-APP-000118-CTR-000240 - SRG-APP-000119-CTR-000245 - SRG-APP-000120-CTR-000250 - SRG-APP-000121-CTR-000255 - SRG-APP-000122-CTR-000260 - SRG-APP-000123-CTR-000265 - SRG-APP-000126-CTR-000275 - SRG-APP-000290-CTR-000670 - It is necessary to ensure that any configured output uses the TLS protocol to receive -logs in order to ensure the confidentiality, integrity and authenticity of the logs. - CCE-90688-3 + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + - - + - + - - Ensure that the cluster's audit profile is properly set + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + -OpenShift can audit the details of requests made to the API server through -the standard Kubernetes audit capabilities. +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. -In OpenShift, auditing of the API Server is on by default. Audit provides a -security-relevant chronological set of records documenting the sequence of -activities that have affected system by individual users, administrators, or -other components of the system. Audit works at the API server level, logging -all requests coming to the server. Each audit log contains two entries: +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation -The request line containing: +This rule pertains to the nodefs.available setting of the evictionHard +section. + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + + + + + + + + + + + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: - A Unique ID allowing to match the response line (see #2) - The source IP of the request - The HTTP method being invoked - The original user invoking the operation - The impersonated user for the operation (self meaning himself) - The impersonated group for the operation (lookup meaning user's group) - The namespace of the request or none - The URI as requested + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. -The response line containing: +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: - The aforementioned unique ID - The response code + soft eviction for containers + hard eviction for containers + eviction for images -For more information on how to configure the audit profile, please visit -the documentation +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.available setting of the evictionHard +section. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/apiservers/cluster API endpoint to the local /apis/config.openshift.io/v1/apiservers/cluster file. - CIP-003-8 R4 - CIP-003-8 R4.1 - CIP-003-8 R4.2 - CIP-003-8 R5.2 CIP-003-8 R6 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-004-6 R3.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - CIP-007-3 R6.5 - AU-2 - AU-3 - AU-3(1) - AU-6 - AU-6(1) - AU-7 - AU-7(1) - AU-8 - AU-8(1) - AU-9 - AU-12 - AU-12(1) - CM-5(1) - SI-11 - SI-12 - SI-4(20) - SI-4(23) - Req-2.2 - Req-12.5.5 - SRG-APP-000089-CTR-000150 - SRG-APP-000090-CTR-000155 - SRG-APP-000091-CTR-000160 - SRG-APP-000095-CTR-000170 - SRG-APP-000096-CTR-000175 - SRG-APP-000097-CTR-000180 - SRG-APP-000098-CTR-000185 - SRG-APP-000099-CTR-000190 - SRG-APP-000100-CTR-000195 - SRG-APP-000100-CTR-000200 - SRG-APP-000101-CTR-000205 - SRG-APP-000116-CTR-000235 - SRG-APP-000118-CTR-000240 - SRG-APP-000119-CTR-000245 - SRG-APP-000120-CTR-000250 - SRG-APP-000121-CTR-000255 - SRG-APP-000122-CTR-000260 - SRG-APP-000123-CTR-000265 - SRG-APP-000181-CTR-000485 - SRG-APP-000266-CTR-000625 - SRG-APP-000374-CTR-000865 - SRG-APP-000375-CTR-000870 - SRG-APP-000380-CTR-000900 - SRG-APP-000381-CTR-000905 - SRG-APP-000492-CTR-001220 - SRG-APP-000493-CTR-001225 - SRG-APP-000494-CTR-001230 - SRG-APP-000495-CTR-001235 - SRG-APP-000496-CTR-001240 - SRG-APP-000497-CTR-001245 - SRG-APP-000498-CTR-001250 - SRG-APP-000499-CTR-001255 - SRG-APP-000500-CTR-001260 - SRG-APP-000501-CTR-001265 - SRG-APP-000502-CTR-001270 - SRG-APP-000503-CTR-001275 - SRG-APP-000504-CTR-001280 - SRG-APP-000505-CTR-001285 - SRG-APP-000506-CTR-001290 - SRG-APP-000507-CTR-001295 - SRG-APP-000508-CTR-001300 - SRG-APP-000509-CTR-001305 - SRG-APP-000510-CTR-001310 - 3.2.1 - 3.2.2 - Logging is an important detective control for all systems, to detect potential -unauthorised access. - CCE-83577-7 - --- -apiVersion: config.openshift.io/v1 -kind: APIServer -metadata: - name: cluster -spec: - audit: - profile: {{.var_openshift_audit_profile}} - + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + - + - + - - Ensure that OpenShift Logging Operator is scanning the cluster - OpenShift Logging Operator provides ability to aggregate all the logs from the -OpenShift Container Platform cluster, such as node system audit logs, application -container logs, and infrastructure logs. OpenShift Logging aggregates these logs -from throughout OpenShift cluster and stores them in a default log store. [1] - -[1]https://docs.openshift.com/container-platform/4.10/logging/cluster-logging.html - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterloggings/instance API endpoint to the local /apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterloggings/instance file. - AU-3(2) - SRG-APP-000092-CTR-000165 - SRG-APP-000111-CTR-000220 - OpenShift Logging Operator is able to collect, aggregate, and manage logs. - CCE-85918-1 + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionHard +section. + + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + CCE-84141-1 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionHard: + nodefs.inodesFree: {{.var_kubelet_evictionhard_nodefs_inodesfree}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionHard: + nodefs.inodesFree: {{.var_kubelet_evictionhard_nodefs_inodesfree}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s + + + + - + - + - - Record Access Events to Kubernetes Audit Log Directory - The audit system should collect access events to read the Kubernetes audit log directory. -The following audit rule will assure that access to audit log directory are -collected. --a always,exit -F dir=/var/log/kube-apiserver/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rule to a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rule to -/etc/audit/audit.rules file. - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - SRG-APP-000343-CTR-000780 - Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise.' - - CCE-83640-3 - --- -# - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20dir%3D/var/log/kube-apiserver/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A }} - mode: 0600 - path: /etc/audit/rules.d/30-access-var-log-kube-audit.rules - overwrite: true - + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionHard +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + - + - + - - Record Access Events to OAuth Audit Log Directory - The audit system should collect access events to read the OAuth audit log directory. -The following audit rule will assure that access to audit log directory are -collected. --a always,exit -F dir=/var/log/oauth-apiserver/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rule to a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rule to -/etc/audit/audit.rules file. - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - SRG-APP-000343-CTR-000780 - Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise.' - - CCE-90631-3 - --- -# - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20dir%3D/var/log/oauth-apiserver/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A }} - mode: 0600 - path: /etc/audit/rules.d/30-access-var-log-oauth-audit.rules - overwrite: true - + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionHard +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Record Access Events to OpenShift Audit Log Directory - The audit system should collect access events to read the OpenShift audit log directory. -The following audit rule will assure that access to audit log directory are -collected. --a always,exit -F dir=/var/log/openshift-apiserver/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rule to a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rule to -/etc/audit/audit.rules file. - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - SRG-APP-000343-CTR-000780 - Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise.' - - CCE-90632-1 - --- -# - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20dir%3D/var/log/openshift-apiserver/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A }} - mode: 0600 - path: /etc/audit/rules.d/30-access-var-log-ocp-audit.rules - overwrite: true - + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionHard +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - The Kubernetes Audit Logs Directory Must Have Mode 0700 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available -To properly set the permissions of /var/log/kube-apiserver/, run the command: -$ sudo chmod 0700 /var/log/kube-apiserver/ - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.2 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-004-6 R3.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CIP-007-3 R6.5 - CM-6(a) - AC-6(1) - AU-9 - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - SRG-APP-000118-CTR-000240 - SRG-APP-000119-CTR-000245 - SRG-APP-000120-CTR-000250 - SRG-APP-000121-CTR-000255 - SRG-APP-000122-CTR-000260 - SRG-APP-000123-CTR-000265 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-83645-2 + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.available setting of the evictionSoft +section. + + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + CCE-84127-0 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoft: + imagefs.available: {{.var_kubelet_evictionsoft_imagefs_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + imagefs.available: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoft: + imagefs.available: {{.var_kubelet_evictionsoft_imagefs_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + imagefs.available: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s + - + + + + + - + - - The OAuth Audit Logs Directory Must Have Mode 0700 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available -To properly set the permissions of /var/log/oauth-apiserver/, run the command: -$ sudo chmod 0700 /var/log/oauth-apiserver/ - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.2 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-004-6 R3.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CIP-007-3 R6.5 - CM-6(a) - AC-6(1) - AU-9 - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - SRG-APP-000118-CTR-000240 - SRG-APP-000119-CTR-000245 - SRG-APP-000120-CTR-000250 - SRG-APP-000121-CTR-000255 - SRG-APP-000122-CTR-000260 - SRG-APP-000123-CTR-000265 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-90633-9 + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.available setting of the evictionSoft +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + - + - + - - The OpenShift Audit Logs Directory Must Have Mode 0700 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available -To properly set the permissions of /var/log/openshift-apiserver/, run the command: -$ sudo chmod 0700 /var/log/openshift-apiserver/ - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.2 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-004-6 R3.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CIP-007-3 R6.5 - CM-6(a) - AC-6(1) - AU-9 - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - SRG-APP-000118-CTR-000240 - SRG-APP-000119-CTR-000245 - SRG-APP-000120-CTR-000250 - SRG-APP-000121-CTR-000255 - SRG-APP-000122-CTR-000260 - SRG-APP-000123-CTR-000265 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-90634-7 + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.available setting of the evictionSoft +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Kubernetes Audit Logs Must Be Owned By Root - All audit logs must be owned by root user and group. By default, the path for the Kubernetes audit log is /var/log/kube-apiserver/. - -To properly set the owner of /var/log/kube-apiserver, run the command: -$ sudo chown root /var/log/kube-apiserver - -To properly set the owner of /var/log/kube-apiserver/*, run the command: -$ sudo chown root /var/log/kube-apiserver/* - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - CCI-000162 - CCI-000163 - CCI-000164 - CCI-001314 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - SRG-OS-000206-GPOS-00084 - Unauthorized disclosure of audit records can reveal system and configuration data to -attackers, thus compromising its confidentiality. - - CCE-83650-2 - - - - - - - - - OAuth Audit Logs Must Be Owned By Root - All audit logs must be owned by root user and group. By default, the path for the OAuth audit log is /var/log/oauth-apiserver/. - -To properly set the owner of /var/log/oauth-apiserver, run the command: -$ sudo chown root /var/log/oauth-apiserver - -To properly set the owner of /var/log/oauth-apiserver/*, run the command: -$ sudo chown root /var/log/oauth-apiserver/* - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - CCI-000162 - CCI-000163 - CCI-000164 - CCI-001314 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - SRG-OS-000206-GPOS-00084 - Unauthorized disclosure of audit records can reveal system and configuration data to -attackers, thus compromising its confidentiality. - - CCE-90635-4 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.available setting of the evictionSoft +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - OpenShift Audit Logs Must Be Owned By Root - All audit logs must be owned by root user and group. By default, the path for the OpenShift audit log is /var/log/openshift-apiserver/. - -To properly set the owner of /var/log/openshift-apiserver, run the command: -$ sudo chown root /var/log/openshift-apiserver - -To properly set the owner of /var/log/openshift-apiserver/*, run the command: -$ sudo chown root /var/log/openshift-apiserver/* - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - CCI-000162 - CCI-000163 - CCI-000164 - CCI-001314 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - SRG-OS-000206-GPOS-00084 - Unauthorized disclosure of audit records can reveal system and configuration data to -attackers, thus compromising its confidentiality. - - CCE-90636-2 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.inodesFree setting of the evictionSoft +section. + + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + CCE-84132-0 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoft: + imagefs.inodesFree: {{.var_kubelet_evictionsoft_imagefs_inodesfree}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + imagefs.inodesFree: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoft: + imagefs.inodesFree: {{.var_kubelet_evictionsoft_imagefs_inodesfree}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + imagefs.inodesFree: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s + - + + + + + - + - - Kubernetes Audit Logs Must Have Mode 0600 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree -To properly set the permissions of /var/log/kube-apiserver/.*, run the command: -$ sudo chmod 0600 /var/log/kube-apiserver/.* - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-83654-4 + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.inodesFree setting of the evictionSoft +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + - + - + - - OAuth Audit Logs Must Have Mode 0600 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree -To properly set the permissions of /var/log/oauth-apiserver/.*, run the command: -$ sudo chmod 0600 /var/log/oauth-apiserver/.* - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-90637-0 + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.inodesFree setting of the evictionSoft +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - OpenShift Audit Logs Must Have Mode 0600 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree -To properly set the permissions of /var/log/openshift-apiserver/.*, run the command: -$ sudo chmod 0600 /var/log/openshift-apiserver/.* - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-90638-8 + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the imagefs.inodesFree setting of the evictionSoft +section. + + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Ensure /var/log/kube-apiserver Located On Separate Partition - Kubernetes API server audit logs are stored in the -/var/log/kube-apiserver directory. - -Partitioning Red Hat CoreOS is a Day 1 operation and cannot -be changed afterwards. For documentation on how to add a -MachineConfig manifest that specifies a separate /var/log/kube-apiserver -partition, follow: - - https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. - -Note that the Red Hat OpenShift documentation often references a block -device, such as /dev/vda. The name of the available block devices depends -on the underlying infrastructure (bare metal vs cloud), and often the specific -instance type. For example in AWS, some instance types have NVMe drives -(/dev/nvme*), others use /dev/xvda*. - -You will need to look for relevant documentation for your infrastructure around this. -In many cases, the simplest thing is to boot a single machine with an Ignition -configuration that just gives you SSH access, and inspect the block devices via -e.g. the lsblk command. - -For physical hardware, a good best practice is to reference devices via the -/dev/disk/by-id/ or /dev/disk/by-path links. - - AU-4 - Req-10.5.3 - Req-10.5.4 - SRG-APP-000357-CTR-000800 - Placing /var/log/kube-apiserver in its own partition -enables better separation between Kubernetes API server audit -files and other log files, and helps ensure that -auditing cannot be halted due to the partition running out -of space. - - CCE-86456-1 - - - - - - Ensure /var/log/oauth-apiserver Located On Separate Partition - OpenShift OAuth server audit logs are stored in the -/var/log/oauth-apiserver directory. - -Partitioning Red Hat CoreOS is a Day 1 operation and cannot -be changed afterwards. For documentation on how to add a -MachineConfig manifest that specifies a separate /var/log/oauth-apiserver -partition, follow: - - https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: - -Note that the Red Hat OpenShift documentation often references a block -device, such as /dev/vda. The name of the available block devices depends -on the underlying infrastructure (bare metal vs cloud), and often the specific -instance type. For example in AWS, some instance types have NVMe drives -(/dev/nvme*), others use /dev/xvda*. - -You will need to look for relevant documentation for your infrastructure around this. -In many cases, the simplest thing is to boot a single machine with an Ignition -configuration that just gives you SSH access, and inspect the block devices via -e.g. the lsblk command. - -For physical hardware, a good best practice is to reference devices via the -/dev/disk/by-id/ or /dev/disk/by-path links. - - AU-4 - Req-10.5.3 - Req-10.5.4 - SRG-APP-000357-CTR-000800 - Placing /var/log/oauth-apiserver in its own partition -enables better separation between OpenShift OAuth server audit -files and other log files, and helps ensure that -auditing cannot be halted due to the partition running out -of space. - - CCE-85954-6 - - - - - - Ensure /var/log/openshift-apiserver Located On Separate Partition - Openshift API server audit logs are stored in the -/var/log/openshift-apiserver directory. - -Partitioning Red Hat CoreOS is a Day 1 operation and cannot -be changed afterwards. For documentation on how to add a -MachineConfig manifest that specifies a separate /var/log/openshift-apiserver -partition, follow: - - https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation - -Note that the Red Hat OpenShift documentation often references a block -device, such as /dev/vda. The name of the available block devices depends -on the underlying infrastructure (bare metal vs cloud), and often the specific -instance type. For example in AWS, some instance types have NVMe drives -(/dev/nvme*), others use /dev/xvda*. - -You will need to look for relevant documentation for your infrastructure around this. -In many cases, the simplest thing is to boot a single machine with an Ignition -configuration that just gives you SSH access, and inspect the block devices via -e.g. the lsblk command. - -For physical hardware, a good best practice is to reference devices via the -/dev/disk/by-id/ or /dev/disk/by-path links. - - AU-4 - Req-10.5.3 - Req-10.5.4 - SRG-APP-000357-CTR-000800 - Placing /var/log/openshift-apiserver in its own partition -enables better separation between Openshift API server audit -files and other log files, and helps ensure that -auditing cannot be halted due to the partition running out -of space. - - CCE-86094-0 - - - - - - - OpenShift - Master Node Settings - Contains evaluations for the master node configuration settings. - - Verify Group Who Owns The OpenShift Container Network Interface Files - To properly set the group owner of /etc/cni/net.d/*, run the command: $ sudo chgrp root /etc/cni/net.d/* + +This rule pertains to the memory.available setting of the evictionSoft +section. + + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11402,28 +11937,115 @@ of space. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84025-6 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + CCE-84222-9 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoft: + memory.available: {{.var_kubelet_evictionsoft_memory_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + memory.available: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoft: + memory.available: {{.var_kubelet_evictionsoft_memory_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + memory.available: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s + - + + + + + - + - - Verify Group Who Owns The OpenShift Controller Manager Kubeconfig File + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available -To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig, run the command: -$ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig - This rule is only applicable for nodes that run the Kubernetes Controller -Manager service. The aforementioned service is only running on -the nodes labeled "master" by default. + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the memory.available setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11432,27 +12054,52 @@ the nodes labeled "master" by default. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.18 - The Controller Manager's kubeconfig contains information about how the -component will access the API server. You should set its file ownership to -maintain the integrity of the file. - - CCE-84095-9 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + - + - + - - Verify Group Who Owns The Etcd Database Directory + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available -To properly set the group owner of /var/lib/etcd/member/, run the command: -$ sudo chgrp root /var/lib/etcd/member/ - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the memory.available setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11461,27 +12108,54 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.12 - etcd is a highly-available key-value store used by Kubernetes deployments for -persistent storage of all of its REST API objects. This data directory should -be protected from any unauthorized reads or writes. - - CCE-83354-1 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Verify Group Who Owns The Etcd Write-Ahead-Log Files + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available -To properly set the group owner of /var/lib/etcd/member/wal/*, run the command: -$ sudo chgrp root /var/lib/etcd/member/wal/* - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the memory.available setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11490,25 +12164,56 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.12 - etcd is a highly-available key-value store used by Kubernetes deployments for -persistent storage of all of its REST API objects. This data directory should -be protected from any unauthorized reads or writes. - - CCE-83816-9 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Verify Group Who Owns The etcd Member Pod Specification File - To properly set the group owner of /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.available setting of the evictionSoft +section. + + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11517,30 +12222,115 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.8 - The etcd pod specification file controls various parameters that -set the behavior of the etcd service in the master node. etcd is a -highly-available key-value store which Kubernetes uses for persistent -storage of all of its REST API object. You should restrict its file -permissions to maintain the integrity of the file. The file should be -writable by only the administrators on the system. - - CCE-83664-3 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + CCE-84119-7 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoft: + nodefs.available: {{.var_kubelet_evictionsoft_nodefs_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + nodefs.available: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoft: + nodefs.available: {{.var_kubelet_evictionsoft_nodefs_available}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + nodefs.available: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s + - + + + + + - + - - Verify Group Who Owns The Etcd PKI Certificate Files + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available -To properly set the group owner of /etc/kubernetes/static-pod-resources/*/*/*/*.crt, run the command: -$ sudo chgrp root /etc/kubernetes/static-pod-resources/*/*/*/*.crt - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.available setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11549,23 +12339,52 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.19 - OpenShift makes use of a number of certificates as part of its operation. -You should verify the ownership of the directory containing the PKI -information and all files in that directory to maintain their integrity. -The directory and files should be owned by the system administrator. - - CCE-83890-4 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + - + - + - - Verify Group Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations - To properly set the group owner of /var/lib/cni/networks/openshift-sdn/.*, run the command: $ sudo chgrp root /var/lib/cni/networks/openshift-sdn/.* + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.available setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11574,26 +12393,54 @@ The directory and files should be owned by the system administrator.SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84211-2 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Verify Group Who Owns The Kubernetes API Server Pod Specification File - To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml - This rule is only applicable for nodes that run the Kubernetes API Server service. -The aforementioned service is only running on the nodes labeled -"master" by default. + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.available setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11602,25 +12449,56 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.2 - The Kubernetes specification file contains information about the configuration of the -Kubernetes API Server that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83530-6 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Verify Group Who Owns The Kubernetes Controller Manager Pod Specification File - To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml - This rule is only applicable for nodes that run the Kubernetes Controller Manager service. -The aforementioned service is only running on the nodes labeled -"master" by default. + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionSoft +section. + + + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11629,25 +12507,115 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.4 - The Kubernetes specification file contains information about the configuration of the -Kubernetes Controller Manager Server that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83953-0 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + CCE-84123-9 + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoft: + nodefs.inodesFree: {{.var_kubelet_evictionsoft_nodefs_inodesfree}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + nodefs.inodesFree: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoft: + nodefs.inodesFree: {{.var_kubelet_evictionsoft_nodefs_inodesfree}} +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionSoftGracePeriod: + nodefs.inodesFree: "1m30s" +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + evictionPressureTransitionPeriod: 0s + - + + + + + - + - - Verify Group Who Owns The Kubernetes Scheduler Pod Specification File - To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml - This rule is only applicable for nodes that run the Kubernetes Scheduler service. -The aforementioned service is only running on the nodes labeled -"master" by default. + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11656,38 +12624,52 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.6 - The Kubernetes Specification file contains information about the configuration of the -Kubernetes scheduler that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83614-8 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. + - - - - + - - - Verify Group Who Owns The OpenShift Admin Kubeconfig File - To properly set the group owner of /etc/kubernetes/kubeconfig, run the command: $ sudo chgrp root /etc/kubernetes/kubeconfig - 1.1.14 - The /etc/kubernetes/kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - + - - Verify Group Who Owns The OpenShift Admin Kubeconfig Files + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree -To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig, run the command: -$ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig - This rule is only applicable for nodes that run the Kubernetes API server service. -The aforementioned service is only running on the nodes labeled -"master" by default. + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11696,26 +12678,54 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.14 - There are various kubeconfig files that can be used by the administrator, -defining various settings for the administration of the cluster. These files -contain credentials that can be used to control the cluster and are needed -for disaster recovery and each kubeconfig points to a different endpoint in -the cluster. You should restrict its file permissions to maintain the -integrity of the kubeconfig file as an attacker who gains access to these -files can take over the cluster. - - CCE-84204-7 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Verify Group Who Owns The OpenShift Multus Container Network Interface Plugin Files - To properly set the group owner of /var/run/multus/cni/net.d/*, run the command: $ sudo chgrp root /var/run/multus/cni/net.d/* + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + + Two types of garbage collection are performed on an OpenShift Container Platform node: + + Container garbage collection: Removes terminated containers. + Image garbage collection: Removes images not referenced by any running pods. + + +Container garbage collection can be performed using eviction thresholds. +Image garbage collection relies on disk usage as reported by cAdvisor on the +node to decide which images to remove from the node. + + +The OpenShift administrator can configure how OpenShift Container Platform +performs garbage collection by creating a kubeletConfig object for each +Machine Config Pool using any combination of the following: + + + soft eviction for containers + hard eviction for containers + eviction for images + + +To configure, follow the directions in +the documentation + + +This rule pertains to the nodefs.inodesFree setting of the evictionSoft +section. + + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11724,154 +12734,135 @@ files can take over the cluster. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83818-5 + 1.3.1 + Garbage collection is important to ensure sufficient resource availability +and avoiding degraded performance and availability. In the worst case, the +system might crash or just be unusable for a long period of time. +Based on your system resources and tests, choose an appropriate threshold +value to activate garbage collection. - + + + + - + - - Verify Group Who Owns The OpenShift PKI Certificate Files - -To properly set the group owner of /etc/kubernetes/static-pod-resources/*/*/*/tls.crt, run the command: -$ sudo chgrp root /etc/kubernetes/static-pod-resources/*/*/*/tls.crt - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. + + kubelet - Ensure that the --read-only-port is secured + Disable the read-only port. + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.19 - OpenShift makes use of a number of certificates as part of its operation. -You should verify the ownership of the directory containing the PKI -information and all files in that directory to maintain their integrity. -The directory and files should be owned by the system administrator. - - CCE-83922-5 + The Kubelet process provides a read-only API in addition to the main Kubelet API. +Unauthenticated access is provided to this read-only API which could possibly retrieve +potentially sensitive information about the cluster. + - + + + + - + - - Verify Group Who Owns The OpenShift PKI Private Key Files - -To properly set the group owner of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command: -$ sudo chgrp root /etc/kubernetes/static-pod-resources/*/*/*/*.key - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. + + kubelet - Ensure that the --read-only-port is secured + Disable the read-only port. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.19 - OpenShift makes use of a number of certificates as part of its operation. -You should verify the ownership of the directory containing the PKI -information and all files in that directory to maintain their integrity. -The directory and files should be owned by root:root. - - CCE-84172-6 + The Kubelet process provides a read-only API in addition to the main Kubelet API. +Unauthenticated access is provided to this read-only API which could possibly retrieve +potentially sensitive information about the cluster. + - + - + - - Verify Group Who Owns The OpenShift SDN CNI Server Config - -To properly set the group owner of /var/run/openshift-sdn/cniserver/config.json, run the command: -$ sudo chgrp root /var/run/openshift-sdn/cniserver/config.json + + kubelet - Ensure that the --read-only-port is secured + Disable the read-only port. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83605-6 - - - - - - - - - Verify Group Who Owns The OpenShift Open vSwitch Files - To properly set the group owner of /etc/openvswitch/.*, run the command: $ sudo chgrp root /etc/openvswitch/.* - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. + The Kubelet process provides a read-only API in addition to the main Kubelet API. +Unauthenticated access is provided to this read-only API which could possibly retrieve +potentially sensitive information about the cluster. + - + + + - + - - Verify Group Who Owns The Open vSwitch Configuration Database - Check if the group owner of /etc/openvswitch/conf.db is -hugetlbfs on architectures other than s390x or openvswitch -on s390x. + + kubelet - Ensure that the --read-only-port is secured + Disable the read-only port. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-88281-1 + The Kubelet process provides a read-only API in addition to the main Kubelet API. +Unauthenticated access is provided to this read-only API which could possibly retrieve +potentially sensitive information about the cluster. + - + + + - + - - Verify Group Who Owns The Open vSwitch Configuration Database Lock - Check if the group owner of /etc/openvswitch/conf.db.~lock~ is -hugetlbfs on architectures other than s390x or openvswitch -on s390x. + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + Ensure that the Kubelet is configured to only use strong cryptographic ciphers. +To set the cipher suites for the kubelet, create new or modify existing +KubeletConfig object along these lines, one for every +MachineConfigPool: + + apiVersion: machineconfiguration.openshift.io/v1 + kind: KubeletConfig + metadata: + name: kubelet-config-$pool + spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + tlsCipherSuites: + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + +In order to configure this rule to check for an alternative cipher, both var_kubelet_tls_cipher_suites_regex +and var_kubelet_tls_cipher_suites have to be set + This rule's check operates on the cluster configuration dump. This will be a Platform rule, var_role_worker and var_role_master needed to be set if scan is not expected to run on master, and worker nodes. +Therefore, you need to use a tool that can query the OCP API, retrieve KubeletConfig through "/api/v1/nodes/NODE_NAME/proxy/configz" API endpoint to the local "/kubeletconfig/role/role" file. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11880,25 +12871,68 @@ on s390x. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-90793-1 + 4.2.13 + TLS ciphers have had a number of known vulnerabilities and weaknesses, +which can reduce the protection provided by them. By default Kubernetes +supports a number of TLS ciphersuites including some that have security +concerns, weakening the protection provided. + + --- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_worker}}" +spec: + kubeletConfig: + tlsCipherSuites: [{{.var_kubelet_tls_cipher_suites}}] +--- +apiVersion: machineconfiguration.openshift.io/v1 +kind: KubeletConfig +metadata: + annotations: + complianceascode.io/node-role: "{{.var_role_master}}" +spec: + kubeletConfig: + tlsCipherSuites: [{{.var_kubelet_tls_cipher_suites}}] + - + + + + + - + - - Verify Group Who Owns The Open vSwitch Configuration Database Lock - -To properly set the group owner of /etc/openvswitch/.conf.db.~lock~, run the command: -$ sudo chgrp hugetlbfs /etc/openvswitch/.conf.db.~lock~ + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + Ensure that the Kubelet is configured to only use strong cryptographic ciphers. +To set the cipher suites for the kubelet, create new or modify existing +KubeletConfig object along these lines, one for every +MachineConfigPool: + + apiVersion: machineconfiguration.openshift.io/v1 + kind: KubeletConfig + metadata: + name: kubelet-config-$pool + spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + tlsCipherSuites: + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + +In order to configure this rule to check for an alternative cipher, both var_kubelet_tls_cipher_suites_regex +and var_kubelet_tls_cipher_suites have to be set CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11907,25 +12941,48 @@ To properly set the group owner of /etc/openvswitch/.conf.db.~lock~SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84219-5 + 4.2.13 + TLS ciphers have had a number of known vulnerabilities and weaknesses, +which can reduce the protection provided by them. By default Kubernetes +supports a number of TLS ciphersuites including some that have security +concerns, weakening the protection provided. + - + + + + - + - - Verify Group Who Owns The Open vSwitch Configuration Database Lock - -To properly set the group owner of /etc/openvswitch/.conf.db.~lock~, run the command: -$ sudo chgrp hugetlbfs /etc/openvswitch/.conf.db.~lock~ + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + Ensure that the Kubelet is configured to only use strong cryptographic ciphers. +To set the cipher suites for the kubelet, create new or modify existing +KubeletConfig object along these lines, one for every +MachineConfigPool: + + apiVersion: machineconfiguration.openshift.io/v1 + kind: KubeletConfig + metadata: + name: kubelet-config-$pool + spec: + machineConfigPoolSelector: + matchLabels: + pools.operator.machineconfiguration.openshift.io/$pool_name: "" + kubeletConfig: + tlsCipherSuites: + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + +In order to configure this rule to check for an alternative cipher, both var_kubelet_tls_cipher_suites_regex +and var_kubelet_tls_cipher_suites have to be set CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -11934,745 +12991,1713 @@ To properly set the group owner of /etc/openvswitch/.conf.db.~lock~SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-85936-3 + 4.2.13 + TLS ciphers have had a number of known vulnerabilities and weaknesses, +which can reduce the protection provided by them. By default Kubernetes +supports a number of TLS ciphersuites including some that have security +concerns, weakening the protection provided. + - + + + + - + - - Verify Group Who Owns The Open vSwitch Configuration Database - -To properly set the group owner of /etc/openvswitch/conf.db, run the command: -$ sudo chgrp hugetlbfs /etc/openvswitch/conf.db - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84226-0 + + + OpenShift - Logging Settings + Contains evaluations for the cluster's logging configuration settings. + + Configure the OpenShift Audit Profile + Audit log profiles define how to log requests that come to the OpenShift +API server, the Kubernetes API server, and the OAuth API server. + Default + Default + WriteRequestBodies + AllRequestBodies + + + Ensure that Audit Log Errors Emit Alerts + +OpenShift audit works at the API server level, logging all requests coming to the server. +However, if API server instance is unable to write errors, an alert must be issued +in order for the organization to take a relevant action. e.g. shutting down that instance. + +Kubernetes by default has metrics that enable one to write such alerts: +apiserver_audit_event_totalapiserver_audit_error_total + +Such an example is shipped in OCP 4.9+ + + +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: audit-errors + namespace: openshift-kube-apiserver +spec: + groups: + - name: apiserver-audit + rules: + - alert: AuditLogError + annotations: + summary: |- + An API Server instance was unable to write audit logs. This could be + triggered by the node running out of space, or a malicious actor + tampering with the audit logs. + description: An API Server had an error writing to an audit log. + expr: | + sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0 + for: 1m + labels: + severity: warning + + + +For more information, consult the +official Kubernetes documentation. + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/monitoring.coreos.com/v1/prometheusrules?limit=500 + API endpoint, filter with with the jq utility using the following filter + [.items[].spec.groups[].rules[].expr] + and persist it to the local + /apis/monitoring.coreos.com/v1/prometheusrules?limit=500#72e9ad360bb6bdf4ad9e43217cd0ec9cb90e7c3b08d4fbe0edf087ad899e05a6 + file. + + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + AU-5 + SRG-APP-000109-CTR-000215 + When there are errors writing audit logs, security events will not be logged +by that specific API Server instance. Security Incident Response teams use +these audit logs, amongst other artifacts, to determine the impact of +security breaches or events. Without these logs, it becomes very difficult +to assess a situation and do appropriate root cause analysis in such incidents. + CCE-90744-4 + --- +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: audit-errors + namespace: openshift-kube-apiserver +spec: + groups: + - name: apiserver-audit + rules: + - alert: AuditLogError + annotations: + summary: |- + An API Server instance was unable to write audit logs. This could be + triggered by the node running out of space, or a malicious actor + tampering with the audit logs. + description: An API Server had an error writing to an audit log. + expr: | + sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0 + for: 1m + labels: + severity: warning + - + + - + - - Verify Group Who Owns The Open vSwitch Configuration Database + + Ensure that Audit Log Forwarding Uses TLS -To properly set the group owner of /etc/openvswitch/conf.db, run the command: -$ sudo chgrp openvswitch /etc/openvswitch/conf.db - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-85927-2 - - - - - - - - - Verify Group Who Owns The Open vSwitch Process ID File - Ensure that the file /var/run/openvswitch/ovs-vswitchd.pid, -is owned by the group openvswitch or hugetlbfs, -depending on your settings and Open vSwitch version. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83630-4 + +OpenShift audit works at the API server level, logging all requests coming to the server. +Audit is on by default and the best practice is to ship audit logs off the cluster for retention +using a secure protocol. + + +The cluster-logging-operator is able to do this with the ClusterLogForwarders resource. +The forementioned resource can be configured to logs to different third party systems. +For more information on this, please reference the official documentation: + + https://docs.openshift.com/container-platform/latest/logging/cluster-logging-external.html + + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the . +This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance + API endpoint, filter with with the jq utility using the following filter + try [.spec.outputs[].url] catch [] + and persist it to the local + /apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance#71786452ba18c51ba8ad51472a078619e2e8b52a86cd75087af5aab42400f6c0 + file. + + CIP-003-8 R5.2 + CIP-004-6 R3.3 + CIP-007-3 R6.5 + AU-9 + AU-9(2) + AU-9(3) + AU-10 + SRG-APP-000118-CTR-000240 + SRG-APP-000119-CTR-000245 + SRG-APP-000120-CTR-000250 + SRG-APP-000121-CTR-000255 + SRG-APP-000122-CTR-000260 + SRG-APP-000123-CTR-000265 + SRG-APP-000126-CTR-000275 + SRG-APP-000290-CTR-000670 + It is necessary to ensure that any configured output uses the TLS protocol to receive +logs in order to ensure the confidentiality, integrity and authenticity of the logs. + CCE-90688-3 - + + - + - - Verify Group Who Owns The Open vSwitch Persistent System ID - Check if the group owner of /etc/openvswitch/system-id.conf is -hugetlbfs on architectures other than s390x or openvswitch -on x390x. + + Ensure that the cluster's audit profile is properly set + + +OpenShift can audit the details of requests made to the API server through +the standard Kubernetes audit capabilities. + + +In OpenShift, auditing of the API Server is on by default. Audit provides a +security-relevant chronological set of records documenting the sequence of +activities that have affected system by individual users, administrators, or +other components of the system. Audit works at the API server level, logging +all requests coming to the server. Each audit log contains two entries: + + +The request line containing: + + + A Unique ID allowing to match the response line (see #2) + The source IP of the request + The HTTP method being invoked + The original user invoking the operation + The impersonated user for the operation (self meaning himself) + The impersonated group for the operation (lookup meaning user's group) + The namespace of the request or none + The URI as requested + + +The response line containing: + + + The aforementioned unique ID + The response code + + +For more information on how to configure the audit profile, please visit +the documentation + + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/apiservers/cluster API endpoint to the local /apis/config.openshift.io/v1/apiservers/cluster file. + CIP-003-8 R4 + CIP-003-8 R4.1 + CIP-003-8 R4.2 + CIP-003-8 R5.2 CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-85892-8 + CIP-004-6 R2.2.2 + CIP-004-6 R2.2.3 + CIP-004-6 R3.3 + CIP-007-3 R.1.3 + CIP-007-3 R5 + CIP-007-3 R5.1.1 + CIP-007-3 R5.2 + CIP-007-3 R5.3.1 + CIP-007-3 R5.3.2 + CIP-007-3 R5.3.3 + CIP-007-3 R6.5 + AU-2 + AU-3 + AU-3(1) + AU-6 + AU-6(1) + AU-7 + AU-7(1) + AU-8 + AU-8(1) + AU-9 + AU-12 + AU-12(1) + CM-5(1) + SI-11 + SI-12 + SI-4(20) + SI-4(23) + Req-2.2 + Req-12.5.5 + SRG-APP-000089-CTR-000150 + SRG-APP-000090-CTR-000155 + SRG-APP-000091-CTR-000160 + SRG-APP-000095-CTR-000170 + SRG-APP-000096-CTR-000175 + SRG-APP-000097-CTR-000180 + SRG-APP-000098-CTR-000185 + SRG-APP-000099-CTR-000190 + SRG-APP-000100-CTR-000195 + SRG-APP-000100-CTR-000200 + SRG-APP-000101-CTR-000205 + SRG-APP-000116-CTR-000235 + SRG-APP-000118-CTR-000240 + SRG-APP-000119-CTR-000245 + SRG-APP-000120-CTR-000250 + SRG-APP-000121-CTR-000255 + SRG-APP-000122-CTR-000260 + SRG-APP-000123-CTR-000265 + SRG-APP-000181-CTR-000485 + SRG-APP-000266-CTR-000625 + SRG-APP-000374-CTR-000865 + SRG-APP-000375-CTR-000870 + SRG-APP-000380-CTR-000900 + SRG-APP-000381-CTR-000905 + SRG-APP-000492-CTR-001220 + SRG-APP-000493-CTR-001225 + SRG-APP-000494-CTR-001230 + SRG-APP-000495-CTR-001235 + SRG-APP-000496-CTR-001240 + SRG-APP-000497-CTR-001245 + SRG-APP-000498-CTR-001250 + SRG-APP-000499-CTR-001255 + SRG-APP-000500-CTR-001260 + SRG-APP-000501-CTR-001265 + SRG-APP-000502-CTR-001270 + SRG-APP-000503-CTR-001275 + SRG-APP-000504-CTR-001280 + SRG-APP-000505-CTR-001285 + SRG-APP-000506-CTR-001290 + SRG-APP-000507-CTR-001295 + SRG-APP-000508-CTR-001300 + SRG-APP-000509-CTR-001305 + SRG-APP-000510-CTR-001310 + 3.2.1 + 3.2.2 + Logging is an important detective control for all systems, to detect potential +unauthorised access. + CCE-83577-7 + --- +apiVersion: config.openshift.io/v1 +kind: APIServer +metadata: + name: cluster +spec: + audit: + profile: {{.var_openshift_audit_profile}} + - + + + - + - - Verify Group Who Owns The Open vSwitch Persistent System ID - -To properly set the group owner of /etc/openvswitch/system-id.conf, run the command: -$ sudo chgrp hugetlbfs /etc/openvswitch/system-id.conf - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83677-5 + + Ensure that OpenShift Logging Operator is scanning the cluster + OpenShift Logging Operator provides ability to aggregate all the logs from the +OpenShift Container Platform cluster, such as node system audit logs, application +container logs, and infrastructure logs. OpenShift Logging aggregates these logs +from throughout OpenShift cluster and stores them in a default log store. [1] + +[1]https://docs.openshift.com/container-platform/4.10/logging/cluster-logging.html + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterloggings/instance API endpoint to the local /apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterloggings/instance file. + AU-3(2) + SRG-APP-000092-CTR-000165 + SRG-APP-000111-CTR-000220 + OpenShift Logging Operator is able to collect, aggregate, and manage logs. + CCE-85918-1 - + + - + - - Verify Group Who Owns The Open vSwitch Persistent System ID - -To properly set the group owner of /etc/openvswitch/system-id.conf, run the command: -$ sudo chgrp hugetlbfs /etc/openvswitch/system-id.conf - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-85928-0 - - - - - - - - - Verify Group Who Owns The Open vSwitch Daemon PID File - Ensure that the file /run/openvswitch/ovs-vswitchd.pid, -is owned by the group openvswitch or hugetlbfs, -depending on your settings and Open vSwitch version. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84129-6 - - - - - - - - - Verify Group Who Owns The Open vSwitch Database Server PID - Ensure that the file /run/openvswitch/ovsdb-server.pid, -is owned by the group openvswitch or hugetlbfs, -depending on your settings and Open vSwitch version. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84166-8 + + Record Access Events to Kubernetes Audit Log Directory + The audit system should collect access events to read the Kubernetes audit log directory. +The following audit rule will assure that access to audit log directory are +collected. +-a always,exit -F dir=/var/log/kube-apiserver/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail +If the auditd daemon is configured to use the augenrules +program to read audit rules during daemon startup (the default), add the +rule to a file with suffix .rules in the directory +/etc/audit/rules.d. +If the auditd daemon is configured to use the auditctl +utility to read audit rules during daemon startup, add the rule to +/etc/audit/audit.rules file. + AU-2(d) + AU-12(c) + AC-6(9) + CM-6(a) + SRG-APP-000343-CTR-000780 + Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. +Auditing these events could serve as evidence of potential system compromise.' + + CCE-83640-3 + --- +# + +apiVersion: machineconfiguration.openshift.io/v1 +kind: MachineConfig +spec: + config: + ignition: + version: 3.1.0 + storage: + files: + - contents: + source: data:,{{ -a%20always%2Cexit%20-F%20dir%3D/var/log/kube-apiserver/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A }} + mode: 0600 + path: /etc/audit/rules.d/30-access-var-log-kube-audit.rules + overwrite: true + - + - + - - Verify Group Who Owns The Kubernetes Scheduler Kubeconfig File - -To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig, run the command: -$ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig - This rule is only applicable for nodes that run the Kubernetes Scheduler service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.16 - The kubeconfig for the Scheduler contains paramters for the scheduler -to access the Kube API. -You should set its file ownership to maintain the integrity of the file. + + Record Access Events to OAuth Audit Log Directory + The audit system should collect access events to read the OAuth audit log directory. +The following audit rule will assure that access to audit log directory are +collected. +-a always,exit -F dir=/var/log/oauth-apiserver/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail +If the auditd daemon is configured to use the augenrules +program to read audit rules during daemon startup (the default), add the +rule to a file with suffix .rules in the directory +/etc/audit/rules.d. +If the auditd daemon is configured to use the auditctl +utility to read audit rules during daemon startup, add the rule to +/etc/audit/audit.rules file. + AU-2(d) + AU-12(c) + AC-6(9) + CM-6(a) + SRG-APP-000343-CTR-000780 + Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. +Auditing these events could serve as evidence of potential system compromise.' - CCE-83471-3 + CCE-90631-3 + --- +# + +apiVersion: machineconfiguration.openshift.io/v1 +kind: MachineConfig +spec: + config: + ignition: + version: 3.1.0 + storage: + files: + - contents: + source: data:,{{ -a%20always%2Cexit%20-F%20dir%3D/var/log/oauth-apiserver/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A }} + mode: 0600 + path: /etc/audit/rules.d/30-access-var-log-oauth-audit.rules + overwrite: true + - + - + - - Verify User Who Owns The OpenShift Container Network Interface Files - To properly set the owner of /etc/cni/net.d/*, run the command: $ sudo chown root /etc/cni/net.d/* - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83460-6 + + Record Access Events to OpenShift Audit Log Directory + The audit system should collect access events to read the OpenShift audit log directory. +The following audit rule will assure that access to audit log directory are +collected. +-a always,exit -F dir=/var/log/openshift-apiserver/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail +If the auditd daemon is configured to use the augenrules +program to read audit rules during daemon startup (the default), add the +rule to a file with suffix .rules in the directory +/etc/audit/rules.d. +If the auditd daemon is configured to use the auditctl +utility to read audit rules during daemon startup, add the rule to +/etc/audit/audit.rules file. + AU-2(d) + AU-12(c) + AC-6(9) + CM-6(a) + SRG-APP-000343-CTR-000780 + Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. +Auditing these events could serve as evidence of potential system compromise.' + + CCE-90632-1 + --- +# + +apiVersion: machineconfiguration.openshift.io/v1 +kind: MachineConfig +spec: + config: + ignition: + version: 3.1.0 + storage: + files: + - contents: + source: data:,{{ -a%20always%2Cexit%20-F%20dir%3D/var/log/openshift-apiserver/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A }} + mode: 0600 + path: /etc/audit/rules.d/30-access-var-log-ocp-audit.rules + overwrite: true + - + - + - - Verify User Who Owns The OpenShift Controller Manager Kubeconfig File + + The Kubernetes Audit Logs Directory Must Have Mode 0700 -To properly set the owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig, run the command: -$ sudo chown root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig - This rule is only applicable for nodes that run the Kubernetes Controller Manager service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.18 - The Controller Manager's kubeconfig contains information about how the -component will access the API server. You should set its file ownership to -maintain the integrity of the file. +To properly set the permissions of /var/log/kube-apiserver/, run the command: +$ sudo chmod 0700 /var/log/kube-apiserver/ + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.2 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-004-6 R3.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CIP-007-3 R6.5 + CM-6(a) + AC-6(1) + AU-9 + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + SRG-APP-000118-CTR-000240 + SRG-APP-000119-CTR-000245 + SRG-APP-000120-CTR-000250 + SRG-APP-000121-CTR-000255 + SRG-APP-000122-CTR-000260 + SRG-APP-000123-CTR-000265 + If users can write to audit logs, audit trails can be modified or destroyed. - CCE-83904-3 + CCE-83645-2 - + - + - - Verify User Who Owns The Etcd Database Directory + + The OAuth Audit Logs Directory Must Have Mode 0700 -To properly set the owner of /var/lib/etcd/member/, run the command: -$ sudo chown root /var/lib/etcd/member/ - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.12 - etcd is a highly-available key-value store used by Kubernetes deployments for -persistent storage of all of its REST API objects. This data directory should -be protected from any unauthorized reads or writes. +To properly set the permissions of /var/log/oauth-apiserver/, run the command: +$ sudo chmod 0700 /var/log/oauth-apiserver/ + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.2 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-004-6 R3.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CIP-007-3 R6.5 + CM-6(a) + AC-6(1) + AU-9 + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + SRG-APP-000118-CTR-000240 + SRG-APP-000119-CTR-000245 + SRG-APP-000120-CTR-000250 + SRG-APP-000121-CTR-000255 + SRG-APP-000122-CTR-000260 + SRG-APP-000123-CTR-000265 + If users can write to audit logs, audit trails can be modified or destroyed. - CCE-83905-0 + CCE-90633-9 - + - + - - Verify User Who Owns The Etcd Write-Ahead-Log Files + + The OpenShift Audit Logs Directory Must Have Mode 0700 -To properly set the owner of /var/lib/etcd/member/wal/*, run the command: -$ sudo chown root /var/lib/etcd/member/wal/* - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.12 - etcd is a highly-available key-value store used by Kubernetes deployments for -persistent storage of all of its REST API objects. This data directory should -be protected from any unauthorized reads or writes. - - CCE-84010-8 - - - - - - - - - Verify User Who Owns The Etcd Member Pod Specification File - To properly set the owner of /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.8 - The etcd pod specification file controls various parameters that -set the behavior of the etcd service in the master node. etcd is a -highly-available key-value store which Kubernetes uses for persistent -storage of all of its REST API object. You should restrict its file -permissions to maintain the integrity of the file. The file should be -writable by only the administrators on the system. - - CCE-83988-6 - - - - - - - - - Verify User Who Owns The Etcd PKI Certificate Files - -To properly set the owner of /etc/kubernetes/static-pod-resources/*/*/*/*.crt, run the command: -$ sudo chown root /etc/kubernetes/static-pod-resources/*/*/*/*.crt - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.19 - OpenShift makes use of a number of certificates as part of its operation. -You should verify the ownership of the directory containing the PKI -information and all files in that directory to maintain their integrity. -The directory and files should be owned by the system administrator. +To properly set the permissions of /var/log/openshift-apiserver/, run the command: +$ sudo chmod 0700 /var/log/openshift-apiserver/ + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.2 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-004-6 R3.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CIP-007-3 R6.5 + CM-6(a) + AC-6(1) + AU-9 + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + SRG-APP-000118-CTR-000240 + SRG-APP-000119-CTR-000245 + SRG-APP-000120-CTR-000250 + SRG-APP-000121-CTR-000255 + SRG-APP-000122-CTR-000260 + SRG-APP-000123-CTR-000265 + If users can write to audit logs, audit trails can be modified or destroyed. - CCE-83898-7 - - - - - - - - - Verify User Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations - To properly set the owner of /var/lib/cni/networks/openshift-sdn/.*, run the command: $ sudo chown root /var/lib/cni/networks/openshift-sdn/.* - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84248-4 + CCE-90634-7 - + - + - - Verify User Who Owns The Kubernetes API Server Pod Specification File - To properly set the owner of /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml - This rule is only applicable for nodes that run the Kubernetes API Server service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.2 - The Kubernetes specification file contains information about the configuration of the -Kubernetes API Server that is configured on the system. Protection of this file is -critical for OpenShift security. + + Kubernetes Audit Logs Must Be Owned By Root + All audit logs must be owned by root user and group. By default, the path for the Kubernetes audit log is /var/log/kube-apiserver/. + +To properly set the owner of /var/log/kube-apiserver, run the command: +$ sudo chown root /var/log/kube-apiserver + +To properly set the owner of /var/log/kube-apiserver/*, run the command: +$ sudo chown root /var/log/kube-apiserver/* + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + 5.4.1.1 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 3.3.1 + CCI-000162 + CCI-000163 + CCI-000164 + CCI-001314 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CM-6(a) + AC-6(1) + AU-9(4) + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + SRG-OS-000057-GPOS-00027 + SRG-OS-000058-GPOS-00028 + SRG-OS-000059-GPOS-00029 + SRG-OS-000206-GPOS-00084 + Unauthorized disclosure of audit records can reveal system and configuration data to +attackers, thus compromising its confidentiality. - CCE-83372-3 + CCE-83650-2 - + - + - - Verify User Who Owns The Kubernetes Controller Manager Pod Specificiation File - To properly set the owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml - This rule is only applicable for nodes that run the Kubernetes Controller Manager service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.4 - The Kubernetes specification file contains information about the configuration of the -Kubernetes Controller Manager Server that is configured on the system. Protection of this file is -critical for OpenShift security. + + OAuth Audit Logs Must Be Owned By Root + All audit logs must be owned by root user and group. By default, the path for the OAuth audit log is /var/log/oauth-apiserver/. + +To properly set the owner of /var/log/oauth-apiserver, run the command: +$ sudo chown root /var/log/oauth-apiserver + +To properly set the owner of /var/log/oauth-apiserver/*, run the command: +$ sudo chown root /var/log/oauth-apiserver/* + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + 5.4.1.1 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 3.3.1 + CCI-000162 + CCI-000163 + CCI-000164 + CCI-001314 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CM-6(a) + AC-6(1) + AU-9(4) + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + SRG-OS-000057-GPOS-00027 + SRG-OS-000058-GPOS-00028 + SRG-OS-000059-GPOS-00029 + SRG-OS-000206-GPOS-00084 + Unauthorized disclosure of audit records can reveal system and configuration data to +attackers, thus compromising its confidentiality. - CCE-83795-5 + CCE-90635-4 - + - + - - Verify User Who Owns The Kubernetes Scheduler Pod Specification File - To properly set the owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml - This rule is only applicable for nodes that run the Kubernetes Scheduler service. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.6 - The Kubernetes specification file contains information about the configuration of the -Kubernetes scheduler that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83393-9 - - - - - - - - - Verify User Who Owns The OpenShift Admin Kubeconfig File - To properly set the owner of /etc/kubernetes/kubeconfig, run the command: $ sudo chown root /etc/kubernetes/kubeconfig - 1.1.14 - The /etc/kubernetes/kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - - - - - - Verify User Who Owns The OpenShift Admin Kubeconfig Files - -To properly set the owner of /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig, run the command: -$ sudo chown root /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.14 - There are various kubeconfig files that can be used by the administrator, -defining various settings for the administration of the cluster. These files -contain credentials that can be used to control the cluster and are needed -for disaster recovery and each kubeconfig points to a different endpoint in -the cluster. You should restrict its file permissions to maintain the -integrity of the kubeconfig file as an attacker who gains access to these -files can take over the cluster. + + OpenShift Audit Logs Must Be Owned By Root + All audit logs must be owned by root user and group. By default, the path for the OpenShift audit log is /var/log/openshift-apiserver/. + +To properly set the owner of /var/log/openshift-apiserver, run the command: +$ sudo chown root /var/log/openshift-apiserver + +To properly set the owner of /var/log/openshift-apiserver/*, run the command: +$ sudo chown root /var/log/openshift-apiserver/* + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + 5.4.1.1 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 3.3.1 + CCI-000162 + CCI-000163 + CCI-000164 + CCI-001314 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CM-6(a) + AC-6(1) + AU-9(4) + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + SRG-OS-000057-GPOS-00027 + SRG-OS-000058-GPOS-00028 + SRG-OS-000059-GPOS-00029 + SRG-OS-000206-GPOS-00084 + Unauthorized disclosure of audit records can reveal system and configuration data to +attackers, thus compromising its confidentiality. - CCE-83719-5 - - - - - - - - - Verify User Who Owns The OpenShift Multus Container Network Interface Plugin Files - To properly set the owner of /var/run/multus/cni/net.d/*, run the command: $ sudo chown root /var/run/multus/cni/net.d/* - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83603-1 + CCE-90636-2 - + - + - - Verify User Who Owns The OpenShift PKI Certificate Files + + Kubernetes Audit Logs Must Have Mode 0600 -To properly set the owner of /etc/kubernetes/static-pod-resources/*/*/*/tls.crt, run the command: -$ sudo chown root /etc/kubernetes/static-pod-resources/*/*/*/tls.crt - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.19 - OpenShift makes use of a number of certificates as part of its operation. -You should verify the ownership of the directory containing the PKI -information and all files in that directory to maintain their integrity. +To properly set the permissions of /var/log/kube-apiserver/.*, run the command: +$ sudo chmod 0600 /var/log/kube-apiserver/.* + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + 5.4.1.1 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 3.3.1 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CM-6(a) + AC-6(1) + AU-9(4) + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + If users can write to audit logs, audit trails can be modified or destroyed. - CCE-83558-7 + CCE-83654-4 - + - + - - Verify User Who Owns The OpenShift PKI Private Key Files + + OAuth Audit Logs Must Have Mode 0600 -To properly set the owner of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command: -$ sudo chown root /etc/kubernetes/static-pod-resources/*/*/*/*.key - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.19 - OpenShift makes use of a number of certificates as part of its operation. -You should verify the ownership of the directory containing the PKI -information and all files in that directory to maintain their integrity. -The directory and files should be owned by root:root. +To properly set the permissions of /var/log/oauth-apiserver/.*, run the command: +$ sudo chmod 0600 /var/log/oauth-apiserver/.* + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + 5.4.1.1 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 3.3.1 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CM-6(a) + AC-6(1) + AU-9(4) + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + If users can write to audit logs, audit trails can be modified or destroyed. - CCE-83435-8 - - - - - - - - - Verify User Who Owns The OpenShift SDN CNI Server Config - -To properly set the owner of /var/run/openshift-sdn/cniserver/config.json, run the command: -$ sudo chown root /var/run/openshift-sdn/cniserver/config.json - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83932-4 - - - - - - - - - Verify User Who Owns The OpenShift Open vSwitch Files - To properly set the owner of /etc/openvswitch/.*, run the command: $ sudo chown root /etc/openvswitch/.* - 1.1.10 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. + CCE-90637-0 - + - + - - Verify User Who Owns The Open vSwitch Configuration Database + + OpenShift Audit Logs Must Have Mode 0600 -To properly set the owner of /etc/openvswitch/conf.db, run the command: -$ sudo chown openvswitch /etc/openvswitch/conf.db - CIP-003-8 R6 - CIP-004-6 R3 - CIP-007-3 R6.1 - CM-6 - CM-6(1) - SRG-APP-000516-CTR-001325 - SRG-APP-000516-CTR-001330 - SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83489-5 +To properly set the permissions of /var/log/openshift-apiserver/.*, run the command: +$ sudo chmod 0600 /var/log/openshift-apiserver/.* + 1 + 11 + 12 + 13 + 14 + 15 + 16 + 18 + 19 + 3 + 4 + 5 + 6 + 7 + 8 + 5.4.1.1 + APO01.06 + APO11.04 + APO12.06 + BAI03.05 + BAI08.02 + DSS02.02 + DSS02.04 + DSS02.07 + DSS03.01 + DSS05.04 + DSS05.07 + DSS06.02 + MEA02.01 + 3.3.1 + 4.2.3.10 + 4.3.3.3.9 + 4.3.3.5.8 + 4.3.3.7.3 + 4.3.4.4.7 + 4.3.4.5.6 + 4.3.4.5.7 + 4.3.4.5.8 + 4.4.2.1 + 4.4.2.2 + 4.4.2.4 + SR 2.1 + SR 2.10 + SR 2.11 + SR 2.12 + SR 2.8 + SR 2.9 + SR 5.2 + SR 6.1 + A.10.1.1 + A.11.1.4 + A.11.1.5 + A.11.2.1 + A.12.4.1 + A.12.4.2 + A.12.4.3 + A.12.4.4 + A.12.7.1 + A.13.1.1 + A.13.1.3 + A.13.2.1 + A.13.2.3 + A.13.2.4 + A.14.1.2 + A.14.1.3 + A.16.1.4 + A.16.1.5 + A.16.1.7 + A.6.1.2 + A.7.1.1 + A.7.1.2 + A.7.3.1 + A.8.2.2 + A.8.2.3 + A.9.1.1 + A.9.1.2 + A.9.2.3 + A.9.4.1 + A.9.4.4 + A.9.4.5 + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.3 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.1 + CIP-007-3 R5.1.2 + CM-6(a) + AC-6(1) + AU-9(4) + DE.AE-3 + DE.AE-5 + PR.AC-4 + PR.DS-5 + PR.PT-1 + RS.AN-1 + RS.AN-4 + Req-10.5.2 + If users can write to audit logs, audit trails can be modified or destroyed. + + CCE-90638-8 - + - + - - Verify User Who Owns The Open vSwitch Configuration Database Lock - -To properly set the owner of /etc/openvswitch/.conf.db.~lock~, run the command: -$ sudo chown openvswitch /etc/openvswitch/.conf.db.~lock~ + + Ensure /var/log/kube-apiserver Located On Separate Partition + Kubernetes API server audit logs are stored in the +/var/log/kube-apiserver directory. + +Partitioning Red Hat CoreOS is a Day 1 operation and cannot +be changed afterwards. For documentation on how to add a +MachineConfig manifest that specifies a separate /var/log/kube-apiserver +partition, follow: + + https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic + + +Note that the Red Hat OpenShift documentation often references a block +device, such as /dev/vda. The name of the available block devices depends +on the underlying infrastructure (bare metal vs cloud), and often the specific +instance type. For example in AWS, some instance types have NVMe drives +(/dev/nvme*), others use /dev/xvda*. + +You will need to look for relevant documentation for your infrastructure around this. +In many cases, the simplest thing is to boot a single machine with an Ignition +configuration that just gives you SSH access, and inspect the block devices via +e.g. the lsblk command. + +For physical hardware, a good best practice is to reference devices via the +/dev/disk/by-id/ or /dev/disk/by-path links. + + AU-4 + Req-10.5.3 + Req-10.5.4 + SRG-APP-000357-CTR-000800 + Placing /var/log/kube-apiserver in its own partition +enables better separation between Kubernetes API server audit +files and other log files, and helps ensure that +auditing cannot be halted due to the partition running out +of space. + + CCE-86456-1 + + + + + + Ensure /var/log/oauth-apiserver Located On Separate Partition + OpenShift OAuth server audit logs are stored in the +/var/log/oauth-apiserver directory. + +Partitioning Red Hat CoreOS is a Day 1 operation and cannot +be changed afterwards. For documentation on how to add a +MachineConfig manifest that specifies a separate /var/log/oauth-apiserver +partition, follow: + + https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic + + +Note that the Red Hat OpenShift documentation often references a block +device, such as /dev/vda. The name of the available block devices depends +on the underlying infrastructure (bare metal vs cloud), and often the specific +instance type. For example in AWS, some instance types have NVMe drives +(/dev/nvme*), others use /dev/xvda*. + +You will need to look for relevant documentation for your infrastructure around this. +In many cases, the simplest thing is to boot a single machine with an Ignition +configuration that just gives you SSH access, and inspect the block devices via +e.g. the lsblk command. + +For physical hardware, a good best practice is to reference devices via the +/dev/disk/by-id/ or /dev/disk/by-path links. + + AU-4 + Req-10.5.3 + Req-10.5.4 + SRG-APP-000357-CTR-000800 + Placing /var/log/oauth-apiserver in its own partition +enables better separation between OpenShift OAuth server audit +files and other log files, and helps ensure that +auditing cannot be halted due to the partition running out +of space. + + CCE-85954-6 + + + + + + Ensure /var/log/openshift-apiserver Located On Separate Partition + Openshift API server audit logs are stored in the +/var/log/openshift-apiserver directory. + +Partitioning Red Hat CoreOS is a Day 1 operation and cannot +be changed afterwards. For documentation on how to add a +MachineConfig manifest that specifies a separate /var/log/openshift-apiserver +partition, follow: + + https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic + + +Note that the Red Hat OpenShift documentation often references a block +device, such as /dev/vda. The name of the available block devices depends +on the underlying infrastructure (bare metal vs cloud), and often the specific +instance type. For example in AWS, some instance types have NVMe drives +(/dev/nvme*), others use /dev/xvda*. + +You will need to look for relevant documentation for your infrastructure around this. +In many cases, the simplest thing is to boot a single machine with an Ignition +configuration that just gives you SSH access, and inspect the block devices via +e.g. the lsblk command. + +For physical hardware, a good best practice is to reference devices via the +/dev/disk/by-id/ or /dev/disk/by-path links. + + AU-4 + Req-10.5.3 + Req-10.5.4 + SRG-APP-000357-CTR-000800 + Placing /var/log/openshift-apiserver in its own partition +enables better separation between Openshift API server audit +files and other log files, and helps ensure that +auditing cannot be halted due to the partition running out +of space. + + CCE-86094-0 + + + + + + + OpenShift - Master Node Settings + Contains evaluations for the master node configuration settings. + + Verify Group Who Owns The OpenShift Container Network Interface Files + To properly set the group owner of /etc/cni/net.d/*, run the command: $ sudo chgrp root /etc/cni/net.d/* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -12681,25 +14706,28 @@ To properly set the owner of /etc/openvswitch/.conf.db.~lock~SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 + 1.1.10 CNI (Container Network Interface) files consist of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - CCE-83462-2 + CCE-84025-6 - + - + - - Verify User Who Owns The Open vSwitch Process ID File + + Verify Group Who Owns The OpenShift Controller Manager Kubeconfig File -To properly set the owner of /var/run/openvswitch/ovs-vswitchd.pid, run the command: -$ sudo chown openvswitch /var/run/openvswitch/ovs-vswitchd.pid +To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig, run the command: +$ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig + This rule is only applicable for nodes that run the Kubernetes Controller +Manager service. The aforementioned service is only running on +the nodes labeled "master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -12708,25 +14736,27 @@ To properly set the owner of /var/run/openvswitch/ovs-vswitchd.pidSRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83937-3 + 1.1.18 + The Controller Manager's kubeconfig contains information about how the +component will access the API server. You should set its file ownership to +maintain the integrity of the file. + + CCE-84095-9 - + - + - - Verify User Who Owns The Open vSwitch Persistent System ID + + Verify Group Who Owns The Etcd Database Directory -To properly set the owner of /etc/openvswitch/system-id.conf, run the command: -$ sudo chown openvswitch /etc/openvswitch/system-id.conf +To properly set the group owner of /var/lib/etcd/member/, run the command: +$ sudo chgrp root /var/lib/etcd/member/ + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -12735,25 +14765,27 @@ To properly set the owner of /etc/openvswitch/system-id.confSRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-84085-0 + 1.1.12 + etcd is a highly-available key-value store used by Kubernetes deployments for +persistent storage of all of its REST API objects. This data directory should +be protected from any unauthorized reads or writes. + + CCE-83354-1 - + - + - - Verify User Who Owns The Open vSwitch Daemon PID File + + Verify Group Who Owns The Etcd Write-Ahead-Log Files -To properly set the owner of /run/openvswitch/ovs-vswitchd.pid, run the command: -$ sudo chown openvswitch /run/openvswitch/ovs-vswitchd.pid +To properly set the group owner of /var/lib/etcd/member/wal/*, run the command: +$ sudo chgrp root /var/lib/etcd/member/wal/* + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -12762,25 +14794,25 @@ To properly set the owner of /run/openvswitch/ovs-vswitchd.pidSRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83888-8 + 1.1.12 + etcd is a highly-available key-value store used by Kubernetes deployments for +persistent storage of all of its REST API objects. This data directory should +be protected from any unauthorized reads or writes. + + CCE-83816-9 - + - + - - Verify User Who Owns The Open vSwitch Database Server PID - -To properly set the owner of /run/openvswitch/ovsdb-server.pid, run the command: -$ sudo chown openvswitch /run/openvswitch/ovsdb-server.pid + + Verify Group Who Owns The etcd Member Pod Specification File + To properly set the group owner of /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -12789,26 +14821,28 @@ To properly set the owner of /run/openvswitch/ovsdb-server.pidSRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83806-0 + 1.1.8 + The etcd pod specification file controls various parameters that +set the behavior of the etcd service in the master node. etcd is a +highly-available key-value store which Kubernetes uses for persistent +storage of all of its REST API object. You should restrict its file +permissions to maintain the integrity of the file. The file should be +writable by only the administrators on the system. + + CCE-83664-3 - + - + - - Verify User Who Owns The Kubernetes Scheduler Kubeconfig File + + Verify Group Who Owns The Etcd PKI Certificate Files -To properly set the owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig, run the command: -$ sudo chown root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig - This rule is only applicable for nodes that run the Kubernetes Scheduler service. +To properly set the group owner of /etc/kubernetes/static-pod-resources/*/*/*/*.crt, run the command: +$ sudo chgrp root /etc/kubernetes/static-pod-resources/*/*/*/*.crt + This rule is only applicable for nodes that run the Etcd service. The aforementioned service is only running on the nodes labeled "master" by default. CIP-003-8 R6 @@ -12819,38 +14853,23 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.16 - The kubeconfig for the Scheduler contains paramters for the scheduler -to access the Kube API. -You should set its file ownership to maintain the integrity of the file. + 1.1.19 + OpenShift makes use of a number of certificates as part of its operation. +You should verify the ownership of the directory containing the PKI +information and all files in that directory to maintain their integrity. +The directory and files should be owned by the system administrator. - CCE-84017-3 - - - - - - - - - Verify User Who Owns The OpenShift etcd Data Directory - To properly set the owner of /var/lib/etcd, run the command: $ sudo chown root /var/lib/etcd - 1.1.12 - The /var/lib/etcd directory contains highly-avaliable distributed key/value data storage -across an OpenShift cluster. Allowing access to users to this directory could compromise OpenShift -data and the cluster. + CCE-83890-4 - + - + - - Verify Permissions on the OpenShift Container Network Interface Files - -To properly set the permissions of /etc/cni/net.d/*, run the command: -$ sudo chmod 0644 /etc/cni/net.d/* + + Verify Group Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations + To properly set the group owner of /var/lib/cni/networks/openshift-sdn/.*, run the command: $ sudo chgrp root /var/lib/cni/networks/openshift-sdn/.* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -12859,26 +14878,24 @@ To properly set the permissions of /etc/cni/net.d/*, run SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 + 1.1.10 CNI (Container Network Interface) files consist of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - - CCE-83379-8 + + CCE-84211-2 - + - + - - Verify Permissions on the OpenShift Controller Manager Kubeconfig File - -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig, run the command: -$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig - This rule is only applicable for nodes that run the Kubernetes Controller Manager service. + + Verify Group Who Owns The Kubernetes API Server Pod Specification File + To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml + This rule is only applicable for nodes that run the Kubernetes API Server service. The aforementioned service is only running on the nodes labeled "master" by default. CIP-003-8 R6 @@ -12889,26 +14906,23 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.17 - The Controller Manager's kubeconfig contains information about how the -component will access the API server. You should restrict its file -permissions to maintain the integrity of the file. The file should be -writable by only the administrators on the system. + 1.1.2 + The Kubernetes specification file contains information about the configuration of the +Kubernetes API Server that is configured on the system. Protection of this file is +critical for OpenShift security. - CCE-83604-9 + CCE-83530-6 - + - + - - Verify Permissions on the Etcd Database Directory - -To properly set the permissions of /var/lib/etcd, run the command: -$ sudo chmod 0700 /var/lib/etcd - This rule is only applicable for nodes that run the Etcd service. + + Verify Group Who Owns The Kubernetes Controller Manager Pod Specification File + To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml + This rule is only applicable for nodes that run the Kubernetes Controller Manager service. The aforementioned service is only running on the nodes labeled "master" by default. CIP-003-8 R6 @@ -12919,26 +14933,23 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.11 - etcd is a highly-available key-value store used by Kubernetes deployments for persistent -storage of all of its REST API objects. This data directory should be protected from any -unauthorized reads or writes. It should not be readable or writable by any group members -or the world. + 1.1.4 + The Kubernetes specification file contains information about the configuration of the +Kubernetes Controller Manager Server that is configured on the system. Protection of this file is +critical for OpenShift security. - CCE-84013-2 + CCE-83953-0 - + - + - - Verify Permissions on the Etcd Write-Ahead-Log Files - -To properly set the permissions of /var/lib/etcd/member/wal/*, run the command: -$ sudo chmod 0600 /var/lib/etcd/member/wal/* - This rule is only applicable for nodes that run the Etcd service. + + Verify Group Who Owns The Kubernetes Scheduler Pod Specification File + To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command: $ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml + This rule is only applicable for nodes that run the Kubernetes Scheduler service. The aforementioned service is only running on the nodes labeled "master" by default. CIP-003-8 R6 @@ -12949,26 +14960,36 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.11 - etcd is a highly-available key-value store used by Kubernetes deployments for persistent -storage of all of its REST API objects. This data directory should be protected from any -unauthorized reads or writes. It should not be readable or writable by any group members -or the world. + 1.1.6 + The Kubernetes Specification file contains information about the configuration of the +Kubernetes scheduler that is configured on the system. Protection of this file is +critical for OpenShift security. - CCE-83382-2 + CCE-83614-8 - + - + - - Verify Permissions on the Etcd Member Pod Specification File + + Verify Group Who Owns The OpenShift Admin Kubeconfig File + To properly set the group owner of /etc/kubernetes/kubeconfig, run the command: $ sudo chgrp root /etc/kubernetes/kubeconfig + 1.1.14 + The /etc/kubernetes/kubeconfig file contains information about the administrative configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + + + + + + Verify Group Who Owns The OpenShift Admin Kubeconfig Files -To properly set the permissions of /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml, run the command: -$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml - This rule is only applicable for nodes that run the Etcd service. +To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig, run the command: +$ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig + This rule is only applicable for nodes that run the Kubernetes API server service. The aforementioned service is only running on the nodes labeled "master" by default. CIP-003-8 R6 @@ -12979,30 +15000,26 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.7 - The etcd pod specification file controls various parameters that -set the behavior of the etcd service in the master node. etcd is a -highly-available key-value store which Kubernetes uses for persistent -storage of all of its REST API object. You should restrict its file -permissions to maintain the integrity of the file. The file should be -writable by only the administrators on the system. + 1.1.14 + There are various kubeconfig files that can be used by the administrator, +defining various settings for the administration of the cluster. These files +contain credentials that can be used to control the cluster and are needed +for disaster recovery and each kubeconfig points to a different endpoint in +the cluster. You should restrict its file permissions to maintain the +integrity of the kubeconfig file as an attacker who gains access to these +files can take over the cluster. - CCE-83973-8 + CCE-84204-7 - + - + - - Verify Permissions on the Etcd PKI Certificate Files - -To properly set the permissions of /etc/kubernetes/static-pod-resources/etcd-*/secrets/*/*.crt, run the command: -$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/etcd-*/secrets/*/*.crt - This rule is only applicable for nodes that run the Etcd service. -The aforementioned service is only running on the nodes labeled -"master" by default. + + Verify Group Who Owns The OpenShift Multus Container Network Interface Plugin Files + To properly set the group owner of /var/run/multus/cni/net.d/*, run the command: $ sudo chgrp root /var/run/multus/cni/net.d/* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13011,24 +15028,28 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.20 - OpenShift makes use of a number of certificate files as part of the operation -of its components. The permissions on these files should be set to -600 or more restrictive to protect their integrity. - - CCE-83362-4 + 1.1.10 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83818-5 - + - + - - Verify Permissions on the OpenShift SDN Container Network Interface Plugin IP Address Allocations + + Verify Group Who Owns The OpenShift PKI Certificate Files -To properly set the permissions of /var/lib/cni/networks/openshift-sdn/*, run the command: -$ sudo chmod 0644 /var/lib/cni/networks/openshift-sdn/* +To properly set the group owner of /etc/kubernetes/static-pod-resources/*/*/*/tls.crt, run the command: +$ sudo chgrp root /etc/kubernetes/static-pod-resources/*/*/*/tls.crt + This rule is only applicable for nodes that run the Kubernetes Control Plane. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13037,26 +15058,26 @@ To properly set the permissions of /var/lib/cni/networks/openshift-sd SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 - CNI (Container Network Interface) files consist of a specification and libraries for -writing plugins to configure network interfaces in Linux containers, along with a number -of supported plugins. Allowing writeable access to the files could allow an attacker to modify -the networking configuration potentially adding a rogue network connection. - - CCE-83469-7 + 1.1.19 + OpenShift makes use of a number of certificates as part of its operation. +You should verify the ownership of the directory containing the PKI +information and all files in that directory to maintain their integrity. +The directory and files should be owned by the system administrator. + + CCE-83922-5 - + - + - - Verify Permissions on the Kubernetes API Server Pod Specification File + + Verify Group Who Owns The OpenShift PKI Private Key Files -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml, run the command: -$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml - This rule is only applicable for nodes that run the Kubernetes API Server service. +To properly set the group owner of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command: +$ sudo chgrp root /etc/kubernetes/static-pod-resources/*/*/*/*.key + This rule is only applicable for nodes that run the Kubernetes Control Plane. The aforementioned service is only running on the nodes labeled "master" by default. CIP-003-8 R6 @@ -13067,28 +15088,25 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.1 - If the Kubernetes specification file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the configuration of -the Kubernetes API server that is configured on the system. Protection of this file is -critical for OpenShift security. + 1.1.19 + OpenShift makes use of a number of certificates as part of its operation. +You should verify the ownership of the directory containing the PKI +information and all files in that directory to maintain their integrity. +The directory and files should be owned by root:root. - CCE-83983-7 + CCE-84172-6 - + - + - - Verify Permissions on the Kubernetes Controller Manager Pod Specificiation File + + Verify Group Who Owns The OpenShift SDN CNI Server Config -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml, run the command: -$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml - This rule is only applicable for nodes that run the Kubernetes Controller Manager service. -The aforementioned service is only running on the nodes labeled -"master" by default. +To properly set the group owner of /var/run/openshift-sdn/cniserver/config.json, run the command: +$ sudo chgrp root /var/run/openshift-sdn/cniserver/config.json CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13097,56 +15115,40 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.3 - If the Kubernetes specification file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the configuration of -an Kubernetes Controller Manager server that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-84161-9 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83605-6 - + - + - - Verify Permissions on the Kube Scheduler Pod Specification File - -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod.yaml, run the command: -$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod.yaml - 1.1.5 - If the Kube specification file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the configuration of -an OpenShift scheduler that is configured on the system. Protection of this file is -critical for OpenShift security. - - + + Verify Group Who Owns The OpenShift Open vSwitch Files + To properly set the group owner of /etc/openvswitch/.*, run the command: $ sudo chgrp root /etc/openvswitch/.* + 1.1.10 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + - - - Verify Permissions on the OpenShift Admin Kubeconfig File - -To properly set the permissions of /etc/kubernetes/kubeconfig, run the command: -$ sudo chmod 0600 /etc/kubernetes/kubeconfig - 1.1.13 - If the /etc/kubernetes/kubeconfig file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the administration configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - + - - Verify Permissions on the OpenShift Admin Kubeconfig Files - -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig, run the command: -$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. + + Verify Group Who Owns The Open vSwitch Configuration Database + Check if the group owner of /etc/openvswitch/conf.db is +hugetlbfs on architectures other than s390x or openvswitch +on s390x. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13155,28 +15157,25 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.13 - There are various kubeconfig files that can be used by the administrator, -defining various settings for the administration of the cluster. These files -contain credentials that can be used to control the cluster and are needed -for disaster recovery and each kubeconfig points to a different endpoint in -the cluster. You should restrict its file permissions to maintain the -integrity of the kubeconfig file as an attacker who gains access to these -files can take over the cluster. - - CCE-84278-1 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-88281-1 - + - + - - Verify Permissions on the OpenShift Multus Container Network Interface Plugin Files - -To properly set the permissions of /var/run/multus/cni/net.d/*, run the command: -$ sudo chmod 0644 /var/run/multus/cni/net.d/* + + Verify Group Who Owns The Open vSwitch Configuration Database Lock + Check if the group owner of /etc/openvswitch/conf.db.~lock~ is +hugetlbfs on architectures other than s390x or openvswitch +on s390x. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13191,22 +15190,19 @@ writing plugins to configure network interfaces in Linux containers, along with of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - CCE-83467-1 + CCE-90793-1 - + - + - - Verify Permissions on the OpenShift PKI Certificate Files + + Verify Group Who Owns The Open vSwitch Configuration Database Lock -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-*/secrets/*/tls.crt, run the command: -$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/kube-*/secrets/*/tls.crt - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. +To properly set the group owner of /etc/openvswitch/.conf.db.~lock~, run the command: +$ sudo chgrp hugetlbfs /etc/openvswitch/.conf.db.~lock~ CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13215,83 +15211,79 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.20 - OpenShift makes use of a number of certificate files as part of the operation -of its components. The permissions on these files should be set to -600 or more restrictive to protect their integrity. - - CCE-83552-0 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-84219-5 - + - + - - Verify Permissions on the OpenShift PKI Private Key Files + + Verify Group Who Owns The Open vSwitch Configuration Database Lock -To properly set the permissions of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command: -$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/*/*/*/*.key - This rule is only applicable for nodes that run the Kubernetes Control Plane. -The aforementioned service is only running on the nodes labeled -"master" by default. - CIP-003-8 R1.3 - CIP-003-8 R3 - CIP-003-8 R3.1 - CIP-003-8 R3.2 - CIP-003-8 R3.3 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 +To properly set the group owner of /etc/openvswitch/.conf.db.~lock~, run the command: +$ sudo chgrp hugetlbfs /etc/openvswitch/.conf.db.~lock~ + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 CM-6 CM-6(1) - IA-5(2) SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.21 - OpenShift makes use of a number of key files as part of the operation of its -components. The permissions on these files should be set to 600 -to protect their integrity and confidentiality. - - CCE-83580-1 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-85936-3 - + - + - - Verify Permissions on the OpenShift Open vSwitch Files + + Verify Group Who Owns The Open vSwitch Configuration Database -To properly set the permissions of /etc/openvswitch/.*, run the command: -$ sudo chmod 0644 /etc/openvswitch/.* - 1.4.9 +To properly set the group owner of /etc/openvswitch/conf.db, run the command: +$ sudo chgrp hugetlbfs /etc/openvswitch/conf.db + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.9 CNI (Container Network Interface) files consist of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. + + CCE-84226-0 - + - + - - Verify Permissions on the Open vSwitch Configuration Database + + Verify Group Who Owns The Open vSwitch Configuration Database -To properly set the permissions of /etc/openvswitch/conf.db, run the command: -$ sudo chmod 0640 /etc/openvswitch/conf.db +To properly set the group owner of /etc/openvswitch/conf.db, run the command: +$ sudo chgrp openvswitch /etc/openvswitch/conf.db CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13305,20 +15297,20 @@ To properly set the permissions of /etc/openvswitch/conf.db - - CCE-83788-0 + + CCE-85927-2 - + - + - - Verify Permissions on the Open vSwitch Configuration Database Lock - -To properly set the permissions of /etc/openvswitch/.conf.db.~lock~, run the command: -$ sudo chmod 0600 /etc/openvswitch/.conf.db.~lock~ + + Verify Group Who Owns The Open vSwitch Process ID File + Ensure that the file /var/run/openvswitch/ovs-vswitchd.pid, +is owned by the group openvswitch or hugetlbfs, +depending on your settings and Open vSwitch version. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13333,19 +15325,19 @@ writing plugins to configure network interfaces in Linux containers, along with of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - CCE-84202-1 + CCE-83630-4 - + - + - - Verify Permissions on the Open vSwitch Process ID File - -To properly set the permissions of /var/run/openvswitch/ovs-vswitchd.pid, run the command: -$ sudo chmod 0644 /var/run/openvswitch/ovs-vswitchd.pid + + Verify Group Who Owns The Open vSwitch Persistent System ID + Check if the group owner of /etc/openvswitch/system-id.conf is +hugetlbfs on architectures other than s390x or openvswitch +on x390x. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13360,19 +15352,19 @@ writing plugins to configure network interfaces in Linux containers, along with of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - CCE-83666-8 + CCE-85892-8 - + - + - - Verify Permissions on the Open vSwitch Persistent System ID + + Verify Group Who Owns The Open vSwitch Persistent System ID -To properly set the permissions of /etc/openvswitch/system-id.conf, run the command: -$ sudo chmod 0644 /etc/openvswitch/system-id.conf +To properly set the group owner of /etc/openvswitch/system-id.conf, run the command: +$ sudo chgrp hugetlbfs /etc/openvswitch/system-id.conf CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13386,20 +15378,20 @@ To properly set the permissions of /etc/openvswitch/system-id.conf - - CCE-83400-2 + + CCE-83677-5 - + - + - - Verify Permissions on the Open vSwitch Daemon PID File + + Verify Group Who Owns The Open vSwitch Persistent System ID -To properly set the permissions of /run/openvswitch/ovs-vswitchd.pid, run the command: -$ sudo chmod 0644 /run/openvswitch/ovs-vswitchd.pid +To properly set the group owner of /etc/openvswitch/system-id.conf, run the command: +$ sudo chgrp hugetlbfs /etc/openvswitch/system-id.conf CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13413,20 +15405,20 @@ To properly set the permissions of /run/openvswitch/ovs-vswitchd.pid< writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - - CCE-83710-4 + + CCE-85928-0 - + - + - - Verify Permissions on the Open vSwitch Database Server PID - -To properly set the permissions of /run/openvswitch/ovsdb-server.pid, run the command: -$ sudo chmod 0644 /run/openvswitch/ovsdb-server.pid + + Verify Group Who Owns The Open vSwitch Daemon PID File + Ensure that the file /run/openvswitch/ovs-vswitchd.pid, +is owned by the group openvswitch or hugetlbfs, +depending on your settings and Open vSwitch version. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13441,22 +15433,19 @@ writing plugins to configure network interfaces in Linux containers, along with of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - CCE-83679-1 + CCE-84129-6 - + - + - - Verify Permissions on the Kubernetes Scheduler Pod Specification File - -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command: -$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml - This rule is only applicable for nodes that run the Kubernetes Scheduler service. -The aforementioned service is only running on the nodes labeled -"master" by default. + + Verify Group Who Owns The Open vSwitch Database Server PID + Ensure that the file /run/openvswitch/ovsdb-server.pid, +is owned by the group openvswitch or hugetlbfs, +depending on your settings and Open vSwitch version. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13465,25 +15454,25 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.5 - If the Kubernetes specification file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the configuration of -an Kubernetes Scheduler service that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-84057-9 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-84166-8 - + - + - - Verify Permissions on the Kubernetes Scheduler Kubeconfig File + + Verify Group Who Owns The Kubernetes Scheduler Kubeconfig File -To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig, run the command: -$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig +To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig, run the command: +$ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig This rule is only applicable for nodes that run the Kubernetes Scheduler service. The aforementioned service is only running on the nodes labeled "master" by default. @@ -13495,41 +15484,22 @@ The aforementioned service is only running on the nodes labeled SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.15 + 1.1.16 The kubeconfig for the Scheduler contains paramters for the scheduler -to access the Kube API. You should restrict its file permissions to maintain -the integrity of the file. The file should be writable by only the -administrators on the system. +to access the Kube API. +You should set its file ownership to maintain the integrity of the file. - CCE-83772-4 - - - - - - - - - The OpenShift etcd Data Directory Must Have Mode 0700 - -To properly set the permissions of /var/lib/etcd, run the command: -$ sudo chmod 0700 /var/lib/etcd - 1.1.11 - The /var/lib/etcd directory contains highly-avaliable distributed key/value data storage -across an OpenShift cluster. Allowing access to users to this directory could compromise OpenShift -data and the cluster. + CCE-83471-3 - + - + - - Verify Permissions on the OpenShift SDN CNI Server Config - -To properly set the permissions of /var/run/openshift-sdn/cniserver/config.json, run the command: -$ sudo chmod 0444 /var/run/openshift-sdn/cniserver/config.json + + Verify User Who Owns The OpenShift Container Network Interface Files + To properly set the owner of /etc/cni/net.d/*, run the command: $ sudo chown root /etc/cni/net.d/* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -13538,1115 +15508,831 @@ To properly set the permissions of /var/run/openshift-sdn/cniserver/c SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.1.9 + 1.1.10 CNI (Container Network Interface) files consist of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection. - - CCE-83927-4 + + CCE-83460-6 - + - + - - - Kubernetes - Network Configuration and Firewalls - Most systems must be connected to a network of some -sort, and this brings with it the substantial risk of network -attack. This section discusses the security impact of decisions -about networking which must be made when configuring a system. - -This section also discusses firewalls, network access -controls, and other network security frameworks, which allow -system-level rules to be written that can limit an attackers' ability -to connect to your system. These rules can specify that network -traffic should be allowed or denied from certain IP addresses, -hosts, and networks. The rules can also specify which of the -system's network services are available to particular hosts or -networks. - - Ensure that cluster-wide proxy is set + + Verify User Who Owns The OpenShift Controller Manager Kubeconfig File - -Production environments can deny direct access to the Internet and instead have -an HTTP or HTTPS proxy available. - - -The Proxy object is used to manage the cluster-wide egress proxy. Setting this -will ensure that containers get the appropriate environment variables set -to ensure traffic goes to the proxy per organizational requirements. - - -For more information, see the relevant documentation. - - - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/proxies/cluster API endpoint to the local /apis/config.openshift.io/v1/proxies/cluster file. - CIP-004-6 R2.2.4 +To properly set the owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig, run the command: +$ sudo chown root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig + This rule is only applicable for nodes that run the Kubernetes Controller Manager service. +The aforementioned service is only running on the nodes labeled +"master" by default. + CIP-003-8 R6 CIP-004-6 R3 - CIP-007-3 R5.1 CIP-007-3 R6.1 - SC-7(8) - External networks tend to be outside of organizational control. By ensuring -that egress traffic goes through an authorized proxy, one is able to ensure -that expected and safe traffic is coming out, and malicious actors -aren't leaking sensitive information, or calling back from a central command -center to get further instructions upon intrusion. - CCE-90765-9 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.18 + The Controller Manager's kubeconfig contains information about how the +component will access the API server. You should set its file ownership to +maintain the integrity of the file. + + CCE-83904-3 - - + + + + - - Ensure that the CNI in use supports Network Policies - There are a variety of CNI plugins available for Kubernetes. If the CNI in -use does not support Network Policies it may not be possible to effectively -restrict traffic in the cluster. OpenShift supports Kubernetes NetworkPolicy -using a Kubernetes Container Network Interface (CNI) plug-in. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/operator.openshift.io/v1/networks/cluster - API endpoint, filter with with the jq utility using the following filter - [.spec.defaultNetwork.type] - and persist it to the local - /apis/operator.openshift.io/v1/networks/cluster#35e33d6dc1252a03495b35bd1751cac70041a511fa4d282c300a8b83b83e3498 - file. - + + Verify User Who Owns The Etcd Database Directory + +To properly set the owner of /var/lib/etcd/member/, run the command: +$ sudo chown root /var/lib/etcd/member/ + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-1.1.4 - Req-1.2 - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - SRG-APP-000038-CTR-000105 - SRG-APP-000039-CTR-000110 - 5.3.1 - Kubernetes network policies are enforced by the CNI plugin in use. As such -it is important to ensure that the CNI plugin supports both Ingress and -Egress network policies. + 1.1.12 + etcd is a highly-available key-value store used by Kubernetes deployments for +persistent storage of all of its REST API objects. This data directory should +be protected from any unauthorized reads or writes. + + CCE-83905-0 - - + - + - - Ensure that application Namespaces have Network Policies defined. - Use network policies to isolate traffic in your cluster network. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/networking.k8s.io/v1/networkpolicies - API endpoint, filter with with the jq utility using the following filter - [.items[] | select((.metadata.namespace | startswith("openshift") | not) and (.metadata.namespace | startswith("kube-") | not) and .metadata.namespace != "default") | .metadata.namespace] | unique - and persist it to the local - /apis/networking.k8s.io/v1/networkpolicies#51742b3e87275db9eb7fc6c0286a9e536178a2a83e3670b615ceaf545e7fd300 - file. - /api/v1/namespaces - API endpoint, filter with with the jq utility using the following filter - [.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default")] - and persist it to the local - /api/v1/namespaces#34d4beecc95c65d815d9d48fd4fdcb0c521631852ad088ef74e36d012b0e1e0d - file. - - CIP-003-8 R4 - CIP-003-8 R4.2 - CIP-003-8 R5 + + Verify User Who Owns The Etcd Write-Ahead-Log Files + +To properly set the owner of /var/lib/etcd/member/wal/*, run the command: +$ sudo chown root /var/lib/etcd/member/wal/* + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 - CIP-004-6 R2.2.4 CIP-004-6 R3 - CIP-007-3 R2 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 CIP-007-3 R6.1 - AC-4 - AC-4(21) - CA-3(5) CM-6 CM-6(1) - CM-7 - CM-7(1) - SC-7 - SC-7(3) - SC-7(5) - SC-7(8) - SC-7(12) - SC-7(13) - SC-7(18) - SC-7(10) - SI-4(22) - Req-1.1.4 - Req-1.2 - Req-1.2.1 - Req-1.3.1 - Req-1.3.2 - Req-2.2 - SRG-APP-000038-CTR-000105 - SRG-APP-000039-CTR-000110 - SRG-APP-000141-CTR-000315 - SRG-APP-000141-CTR-000320 - SRG-APP-000142-CTR-000325 - SRG-APP-000142-CTR-000330 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - SRG-APP-000645-CTR-001410 - 5.3.2 - Running different applications on the same Kubernetes cluster creates a risk of one -compromised application attacking a neighboring application. Network segmentation is -important to ensure that containers can communicate only with those they are supposed -to. When a network policy is introduced to a given namespace, all traffic not allowed -by the policy is denied. However, if there are no network policies in a namespace all -traffic will be allowed into and out of the pods in that namespace. + 1.1.12 + etcd is a highly-available key-value store used by Kubernetes deployments for +persistent storage of all of its REST API objects. This data directory should +be protected from any unauthorized reads or writes. + + CCE-84010-8 - - + - + - - Ensure that the default Ingress CA (wildcard issuer) has been replaced - Check that the default Ingress CA has been replaced. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/proxies/cluster API endpoint to the local /apis/config.openshift.io/v1/proxies/cluster file. - CIP-007-3 R5.1 - SC-17 - OpenShift auto-generates several PKIs to serve TLS on different -endpoints of the system. It is possible and necessary to configure a -custom PKI which allows external clients to trust the endpoints. - -The Ingress Operator is the component responsible for enabling external -access to OpenShift Container Platform cluster services. The aforementioned -operator creates an internal CA and issues a wildcard certificate that is -valid for applications under the .apps sub-domain. Both the web console -and CLI use this certificate as well. The certificate and key would need -to be replaced since a certificate coming from a trusted provider is -needed. - - - https://docs.openshift.com/container-platform/latest/security/certificates/replacing-default-ingress-certificate.html + + Verify User Who Owns The Etcd Member Pod Specification File + To properly set the owner of /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.8 + The etcd pod specification file controls various parameters that +set the behavior of the etcd service in the master node. etcd is a +highly-available key-value store which Kubernetes uses for persistent +storage of all of its REST API object. You should restrict its file +permissions to maintain the integrity of the file. The file should be +writable by only the administrators on the system. + + CCE-83988-6 - - + - + - - Ensure that the default Ingress certificate has been replaced - Check that the default Ingress certificate has been replaced. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default API endpoint to the local /apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default file. - SC-12 - OpenShift auto-generates several PKIs to serve TLS on different -endpoints of the system. It is possible and necessary to configure a -custom PKI which allows external clients to trust the endpoints. - -The Ingress Operator is the component responsible for enabling external -access to OpenShift Container Platform cluster services. The aforementioned -operator creates an internal CA and issues a wildcard certificate that is -valid for applications under the .apps sub-domain. Both the web console -and CLI use this certificate as well. The certificate and key would need -to be replaced since a certificate coming from a trusted provider is -needed. - - - https://docs.openshift.com/container-platform/latest/security/certificates/replacing-default-ingress-certificate.html + + Verify User Who Owns The Etcd PKI Certificate Files + +To properly set the owner of /etc/kubernetes/static-pod-resources/*/*/*/*.crt, run the command: +$ sudo chown root /etc/kubernetes/static-pod-resources/*/*/*/*.crt + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.19 + OpenShift makes use of a number of certificates as part of its operation. +You should verify the ownership of the directory containing the PKI +information and all files in that directory to maintain their integrity. +The directory and files should be owned by the system administrator. + + CCE-83898-7 - - + - + - - Ensure that all Routes has rate limit enabled - OpenShift has an option to set the IP whitelist for Routes [1] when -creating new Routes. All routes outside the openshift namespaces and -the kube namespaces should use the IP whitelist annotations. Requests -from IP addresses that are not in the whitelist are dropped. - -[1] https://docs.openshift.com/container-platform/latest/networking/routes/route-configuration.html#nw-route-specific-annotations_route-configuration - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/route.openshift.io/v1/routes?limit=500 - API endpoint, filter with with the jq utility using the following filter - [.items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.annotations["haproxy.router.openshift.io/ip_whitelist"] | not) | .metadata.name] - and persist it to the local - /apis/route.openshift.io/v1/routes?limit=500#aec152a4446d7917fcbebee892a2ec3fbdef3b71cc0784c9457b2e54fd64dd3b - file. - - SC-7(5) - The usage of IP whitelist for Routes provides basic protection against unwanted access. - CCE-90596-8 + + Verify User Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations + To properly set the owner of /var/lib/cni/networks/openshift-sdn/.*, run the command: $ sudo chown root /var/lib/cni/networks/openshift-sdn/.* + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.10 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-84248-4 - - + - + - - Ensure that all OpenShift Routes prefer TLS - OpenShift Container Platform provides methods for communicating from -outside the cluster with services running in the cluster. TLS must -be used to protect these communications. OpenShift -Routes provide the ability to configure the needed TLS settings. With -these, one is able to configure that any request coming from the outside -must use TLS. To verify this, ensure that every Route in the system -has a policy of Disable or Redirect to ensure a -secure endpoint is used. The aforementioned policy will be set in -a Routes .spec.tls.insecureEdgeTerminationPolicy setting. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/route.openshift.io/v1/routes?limit=500 API endpoint to the local /apis/route.openshift.io/v1/routes?limit=500 file. - CIP-003-8 R4 - CIP-003-8 R4.2 - CIP-003-8 R5 + + Verify User Who Owns The Kubernetes API Server Pod Specification File + To properly set the owner of /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml + This rule is only applicable for nodes that run the Kubernetes API Server service. +The aforementioned service is only running on the nodes labeled +"master" by default. + CIP-003-8 R6 CIP-004-6 R3 - CIP-007-3 R5.1 - CIP-007-3 R7.1 - AC-4 - AC-4(21) - AC-17(3) - SC-8 - SC-8(1) - SC-8(2) - SI-4 - Req-6.5.4 - SRG-APP-000038-CTR-000105 - SRG-APP-000039-CTR-000110 - SRG-APP-000441-CTR-001090 - SRG-APP-000442-CTR-001095 - Using clear-text in communications coming to or from outside -the cluster's network may leak sensitive information. - CCE-84225-2 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.2 + The Kubernetes specification file contains information about the configuration of the +Kubernetes API Server that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83372-3 - - + - + - - Ensure that all Routes has rate limit enabled - OpenShift has an option to set the rate limit for Routes [1] when creating new Routes. -All routes outside the openshift namespaces and the kube namespaces should use the -rate-limiting annotations. - -[1] https://docs.openshift.com/container-platform/4.9/networking/routes/route-configuration.html#nw-route-specific-annotations_route-configuration - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/route.openshift.io/v1/routes?limit=500 - API endpoint, filter with with the jq utility using the following filter - [.items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | .metadata.name] - and persist it to the local - /apis/route.openshift.io/v1/routes?limit=500#842fa6716f17342d62e70f2755db709b9d7a161cf0338ea8bfae9b06dab5e6cc - file. - - SC-5 - SC-5(1) - SC-5(2) - SRG-APP-000246-CTR-000605 - SRG-APP-000435-CTR-001070 - The usage of rate limit for Routes provides basic protection against distributed denial-of-service (DDoS) attacks. - CCE-90779-0 + + Verify User Who Owns The Kubernetes Controller Manager Pod Specificiation File + To properly set the owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml + This rule is only applicable for nodes that run the Kubernetes Controller Manager service. +The aforementioned service is only running on the nodes labeled +"master" by default. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.4 + The Kubernetes specification file contains information about the configuration of the +Kubernetes Controller Manager Server that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83795-5 - - + - + - - - OpenShift API Server - This section contains recommendations for openshift-apiserver configuration. - - Configure the Audit Log Path - To enable auditing on the OpenShift API Server, the audit log path must be set. -Edit the openshift-apiserver configmap -and set the audit-log-path to a suitable path and file -where audit logs should be written. For example: - -"apiServerArguments":{ - ... - "audit-log-path":"/var/log/openshift-apiserver/audit.log", - ... - - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /api/v1/namespaces/openshift-apiserver/configmaps/config API endpoint to the local /api/v1/namespaces/openshift-apiserver/configmaps/config file. + + Verify User Who Owns The Kubernetes Scheduler Pod Specification File + To properly set the owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command: $ sudo chown root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml + This rule is only applicable for nodes that run the Kubernetes Scheduler service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.2.22 - Auditing of the API Server is not enabled by default. Auditing the API Server -provides a security-relevant chronological set of records documenting the sequence -of activities that have affected the system by users, administrators, or other -system components. - CCE-83547-0 + 1.1.6 + The Kubernetes specification file contains information about the configuration of the +Kubernetes scheduler that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83393-9 - - + - + - - - Role-based Acess Control - Role-based access control (RBAC) objects determine -whether a user is allowed to perform a given action -within a project. - -Cluster administrators can use the cluster roles and -bindings to control who has various access levels to -the OpenShift Container Platform platform itself -and all projects. - -Developers can use local roles and bindings to control -who has access to their projects. Note that authorization -is a separate step from authentication, which is more -about determining the identity of who is taking the action. - - Ensure cluster roles are defined in the cluster - - -RBAC is a critical feature in terms of security for Kubernetes and -OpenShift. It enables administrators to segment the privileges -granted to a service account, and thus allows us to limit the -access to resources that they get. By defining cluster roles appropriately -one is able to codify organizational policy. [1] - - -[1] - https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html - - - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/rbac.authorization.k8s.io/v1/clusterroles?limit=1000 API endpoint to the local /apis/rbac.authorization.k8s.io/v1/clusterroles?limit=1000 file. - Req-7.1.1 - By defining RBAC cluster roles, one is able to limit the permissions -given to a Service Account, and thus limit the blast radius -that an account compromise would have. - CCE-86595-6 - - - + + Verify User Who Owns The OpenShift Admin Kubeconfig File + To properly set the owner of /etc/kubernetes/kubeconfig, run the command: $ sudo chown root /etc/kubernetes/kubeconfig + 1.1.14 + The /etc/kubernetes/kubeconfig file contains information about the administrative configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + + - - Profiling is protected by RBAC - Ensure that the cluster-debugger cluster role includes the /debug/pprof -resource URL. This demonstrates that profiling is protected by RBAC, with a -specific cluster role to allow access. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger API endpoint to the local /apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger file. + + Verify User Who Owns The OpenShift Admin Kubeconfig Files + +To properly set the owner of /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig, run the command: +$ sudo chown root /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig + This rule is only applicable for nodes that run the Kubernetes Control Plane. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.3.2 - 1.4.1 - Profiling allows for the identification of specific performance bottlenecks. -It generates a significant amount of program data that could potentially be -exploited to uncover system and program details. If you are not experiencing -any bottlenecks and do not need the profiler for troubleshooting purposes, it -is recommended to turn it off to reduce the potential attack surface. To -ensure the collected data is not exploited, profiling endpoints are secured -via RBAC (see cluster-debugger role). By default, the profiling endpoints are -accessible only by users bound to cluster-admin or cluster-debugger role. -Profiling can not be disabled. - CCE-84182-5 + 1.1.14 + There are various kubeconfig files that can be used by the administrator, +defining various settings for the administration of the cluster. These files +contain credentials that can be used to control the cluster and are needed +for disaster recovery and each kubeconfig points to a different endpoint in +the cluster. You should restrict its file permissions to maintain the +integrity of the kubeconfig file as an attacker who gains access to these +files can take over the cluster. + + CCE-83719-5 - - + - + - - Ensure that the cluster-admin role is only used where required - The RBAC role cluster-admin provides wide-ranging powers over the -environment and should be used only where and when needed. + + Verify User Who Owns The OpenShift Multus Container Network Interface Plugin Files + To properly set the owner of /var/run/multus/cni/net.d/*, run the command: $ sudo chown root /var/run/multus/cni/net.d/* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 - Req-7.1.2 - Req-10.5.1 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.1.1 - Kubernetes provides a set of default roles where RBAC is used. Some of these -roles such as cluster-admin provide wide-ranging privileges which should -only be applied where absolutely necessary. Roles such as cluster-admin -allow super-user access to perform any action on any resource. When used in -a ClusterRoleBinding, it gives full control over every resource in the -cluster and in all namespaces. When used in a RoleBinding, it gives full -control over every resource in the rolebinding's namespace, including the -namespace itself. + 1.1.10 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83603-1 + + + - + - - Limit Access to Kubernetes Secrets - The Kubernetes API stores secrets, which may be service -account tokens for the Kubernetes API or credentials used -by workloads in the cluster. Access to these secrets should -be restricted to the smallest possible group of users to -reduce the risk of privilege escalation. To restrict users from -secrets, remove get, list, and watch -access to unauthorized users to secret objects in the cluster. + + Verify User Who Owns The OpenShift PKI Certificate Files + +To properly set the owner of /etc/kubernetes/static-pod-resources/*/*/*/tls.crt, run the command: +$ sudo chown root /etc/kubernetes/static-pod-resources/*/*/*/tls.crt + This rule is only applicable for nodes that run the Kubernetes Control Plane. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.1.2 - Inappropriate access to secrets stored within the Kubernetes -cluster can allow for an attacker to gain additional access to -the Kubernetes cluster or external resources whose credentials -are stored as secrets. + 1.1.19 + OpenShift makes use of a number of certificates as part of its operation. +You should verify the ownership of the directory containing the PKI +information and all files in that directory to maintain their integrity. + + CCE-83558-7 + + + - + - - Minimize Access to Pod Creation - The ability to create pods in a namespace can provide a -number of opportunities for privilege escalation. Where -applicable, remove create access to pod -objects in the cluster. + + Verify User Who Owns The OpenShift PKI Private Key Files + +To properly set the owner of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command: +$ sudo chown root /etc/kubernetes/static-pod-resources/*/*/*/*.key + This rule is only applicable for nodes that run the Kubernetes Control Plane. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.1.4 - The ability to create pods in a cluster opens up the cluster -for privilege escalation. + 1.1.19 + OpenShift makes use of a number of certificates as part of its operation. +You should verify the ownership of the directory containing the PKI +information and all files in that directory to maintain their integrity. +The directory and files should be owned by root:root. + + CCE-83435-8 + + + - + - - Ensure roles are defined in the cluster + + Verify User Who Owns The OpenShift SDN CNI Server Config - -RBAC is a critical feature in terms of security for Kubernetes and -OpenShift. It enables administrators to segment the privileges -granted to a service account, and thus allows us to limit the -access to resources that they get. By defining roles appropriately -one is able to codify organizational policy. [1] - - -[1] - https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html - - - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/rbac.authorization.k8s.io/v1/roles?limit=1000 API endpoint to the local /apis/rbac.authorization.k8s.io/v1/roles?limit=1000 file. - Req-7.1.1 - By defining RBAC roles, one is able to limit the permissions -given to a Service Account, and thus limit the blast radius -that an account compromise would have. - CCE-86588-1 - - - - - - - Minimize Wildcard Usage in Cluster and Local Roles - Kubernetes Cluster and Local Roles provide access to resources -based on sets of objects and actions that can be taken on -those objects. It is possible to set either of these using a -wildcard * which matches all items. This violates the -principle of least privilege and leaves a cluster in a more -vulnerable state to privilege abuse. +To properly set the owner of /var/run/openshift-sdn/cniserver/config.json, run the command: +$ sudo chown root /var/run/openshift-sdn/cniserver/config.json CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.1.3 - The principle of least privilege recommends that users are -provided only the access required for their role and nothing -more. The use of wildcard rights grants is likely to provide -excessive rights to the Kubernetes API. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83932-4 + + + - + - - - Kubernetes - Registry Security Practices - Contains evaluations for Kubernetes registry security practices, and cluster-wide registry configuration. - - Allowed registries are configured - The configuration registrySources.allowedRegistries determines the -permitted registries that the OpenShift container runtime can access for builds -and pods. This configuration setting ensures that all registries other than -those specified are blocked. - -You can set the allowed repositories by applying the following manifest using -oc patch, e.g. if you save the following snippet to -/tmp/allowed-registries-patch.yaml - -spec: - registrySources: - allowedRegistries: - - my-trusted-registry.internal.example.com - you would call -oc patch image.config.openshift.io cluster --patch="$(cat /tmp/allowed-registries-patch.yaml)" --type=merge - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/images/cluster API endpoint to the local /apis/config.openshift.io/v1/images/cluster file. - CM-5(3) - CM-7(2) - CM-7(5) - CM-11 - SRG-APP-000131-CTR-000280 - SRG-APP-000131-CTR-000285 - SRG-APP-000384-CTR-000915 - Allowed registries should be configured to restrict the registries that the -OpenShift container runtime can access, and all other registries should be -blocked. + + Verify User Who Owns The OpenShift Open vSwitch Files + To properly set the owner of /etc/openvswitch/.*, run the command: $ sudo chown root /etc/openvswitch/.* + 1.1.10 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. - - + - - - Allowed registries for import are configured - The configuration allowedRegistriesForImport limits the container -image registries from which normal users may import images. This is important -to control, as a user who can stand up a malicious registry can then import -content which claims to include the SHAs of legimitate content layers. -You can set the allowed repositories for import by applying the following -manifest using oc patch, e.g. if you save the following snippet to -/tmp/allowed-import-registries-patch.yaml - -spec: - allowedRegistriesForImport: - - domainName: my-trusted-registry.internal.example.com - insecure: false - you would call -oc patch image.config.openshift.io cluster --patch="$(cat /tmp/allowed-import-registries-patch.yaml)" --type=merge - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/images/cluster API endpoint to the local /apis/config.openshift.io/v1/images/cluster file. - CM-5(3) - CM-7(2) - CM-7(5) - CM-11 - SRG-APP-000131-CTR-000280 - SRG-APP-000131-CTR-000285 - SRG-APP-000384-CTR-000915 - Allowed registries for import should be specified to limit the registries -from which users may import images. - - - + + - - - OpenShift - Risk Assessment Settings - Contains evaluations for the cluster's risk assessment configuration settings. - - Ensure that Compliance Operator is scanning the cluster - The Compliance Operator -scans the hosts and the platform (OCP) -configurations for software flaws and improper configurations according -to different compliance benchmarks. It uses OpenSCAP as a backend, -which is a known and certified tool to do such scans. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/compliance.openshift.io/v1alpha1/compliancesuites?limit=5 API endpoint to the local /apis/compliance.openshift.io/v1alpha1/compliancesuites?limit=5 file. - CIP-003-8 R1.3 - CIP-003-8 R4.3 + + Verify User Who Owns The Open vSwitch Configuration Database + +To properly set the owner of /etc/openvswitch/conf.db, run the command: +$ sudo chown openvswitch /etc/openvswitch/conf.db CIP-003-8 R6 - CIP-004-6 4.1 - CIP-004-6 4.2 CIP-004-6 R3 - CIP-004-6 R4 - CIP-004-6 R4.2 - CIP-005-6 R1 - CIP-005-6 R1.1 - CIP-005-6 R1.2 - CIP-007-3 R3 - CIP-007-3 R3.1 CIP-007-3 R6.1 - CIP-007-3 R8.4 CM-6 CM-6(1) - RA-5 - RA-5(5) - SA-4(8) - Req-2.2.4 - SRG-APP-000414-CTR-001010 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - Vulnerability scanning and risk management are important detective controls -for all systems, to detect potential flaws and unauthorised access. - CCE-83697-3 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83489-5 - - + - + - - - Security Context Constraints (SCC) - Similar to the way that RBAC resources control user access, -administrators can use Security Context Constraints (SCCs) -to control permissions for pods. These permissions include -actions that a pod, a collection of containers, can perform -and what resources it can access. You can use SCCs to define -a set of conditions that a pod must run with in order to be -accepted into the system. - - Permitted SCCs with allowedCapabilities - A regular expression that lists all SCCs that are permitted to set the allowedCapabilities attribute - ^privileged$|^hostnetwork-v2$|^restricted-v2$|^nonroot-v2$ - - - Drop Container Capabilities - Containers should not enable more capabilites than needed as this -opens the door for malicious use. To disable the -capabilities, the appropriate Security Context Constraints (SCCs) -should set all capabilities as * or a list of capabilities in -requiredDropCapabilities. + + Verify User Who Owns The Open vSwitch Configuration Database Lock + +To properly set the owner of /etc/openvswitch/.conf.db.~lock~, run the command: +$ sudo chown openvswitch /etc/openvswitch/.conf.db.~lock~ CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.9 - By default, containers run with a default set of capabilities as assigned -by the Container Runtime which can include dangerous or highly privileged -capabilities. Capabilities should be dropped unless absolutely critical for -the container to run software as added capabilities that are not required -allow for malicious containers or attackers. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83462-2 + + + - + - - Limit Container Capabilities - Containers should not enable more capabilites than needed as this -opens the door for malicious use. To enable only the -required capabilities, the appropriate Security Context Constraints (SCCs) -should set capabilities as a list in allowedCapabilities. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -/apis/security.openshift.io/v1/securitycontextconstraints - API endpoint, filter with with the jq utility using the following filter - [.items[] | select(.metadata.name | test("{{.var_sccs_with_allowed_capabilities_regex}}"; "") | not)] | map(.allowedCapabilities == null) - and persist it to the local - /apis/security.openshift.io/v1/securitycontextconstraints#395df9a25b06bd949effbff7e3071c03493e0dd679ee1c7bfcfcb35647e9328c - file. - + + Verify User Who Owns The Open vSwitch Process ID File + +To properly set the owner of /var/run/openvswitch/ovs-vswitchd.pid, run the command: +$ sudo chown openvswitch /var/run/openvswitch/ovs-vswitchd.pid CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.8 - By default, containers run with a default set of capabilities as assigned -by the Container Runtime which can include dangerous or highly privileged -capabilities. Capabilities should be dropped unless absolutely critical for -the container to run software as added capabilities that are not required -allow for malicious containers or attackers. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83937-3 - - + - + - - Limit Access to the Host IPC Namespace - Containers should not be allowed access to the host's Interprocess Commication (IPC) -namespace. To prevent containers from getting access to a host's -IPC namespace, the appropriate Security Context Constraints (SCCs) -should set allowHostIPC to false. + + Verify User Who Owns The Open vSwitch Persistent System ID + +To properly set the owner of /etc/openvswitch/system-id.conf, run the command: +$ sudo chown openvswitch /etc/openvswitch/system-id.conf CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.3 - A container running in the host's IPC namespace can use IPC -to interact with processes outside the container potentially -allowing an attacker to exploit a host process thereby enabling an -attacker to exploit other services. - CCE-84042-1 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-84085-0 + + + - + - - Limit Use of the CAP_NET_RAW - Containers should not enable more capabilites than needed as this -opens the door for malicious use. CAP_NET_RAW enables a container -to launch a network attack on another container or cluster. To disable the -CAP_NET_RAW capability, the appropriate Security Context Constraints (SCCs) -should set NET_RAW in requiredDropCapabilities. + + Verify User Who Owns The Open vSwitch Daemon PID File + +To properly set the owner of /run/openvswitch/ovs-vswitchd.pid, run the command: +$ sudo chown openvswitch /run/openvswitch/ovs-vswitchd.pid CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.7 - By default, containers run with a default set of capabilities as assigned -by the Container Runtime which can include dangerous or highly privileged -capabilities. If the CAP_NET_RAW is enabled, it may be misused -by malicious containers or attackers. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83888-8 + + + - + - - Limit Access to the Host Network Namespace - Containers should not be allowed access to the host's network -namespace. To prevent containers from getting access to a host's -network namespace, the appropriate Security Context Constraints (SCCs) -should set allowHostNetwork to false. + + Verify User Who Owns The Open vSwitch Database Server PID + +To properly set the owner of /run/openvswitch/ovsdb-server.pid, run the command: +$ sudo chown openvswitch /run/openvswitch/ovsdb-server.pid CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.4 - A container running in the host's network namespace could -access the host network traffic to and from other pods -potentially allowing an attacker to exploit pods and network -traffic. - CCE-83492-9 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83806-0 + + + - + - - Limit Containers Ability to Escalate Privileges - Containers should be limited to only the privileges required -to run and should not be allowed to escalate their privileges. -To prevent containers from escalating privileges, -the appropriate Security Context Constraints (SCCs) -should set allowPrivilegeEscalation to false. + + Verify User Who Owns The Kubernetes Scheduler Kubeconfig File + +To properly set the owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig, run the command: +$ sudo chown root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig + This rule is only applicable for nodes that run the Kubernetes Scheduler service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.5 - Privileged containers have access to more of the Linux Kernel -capabilities and devices. If a privileged container were -compromised, an attacker would have full access to the container -and host. - CCE-83447-3 + 1.1.16 + The kubeconfig for the Scheduler contains paramters for the scheduler +to access the Kube API. +You should set its file ownership to maintain the integrity of the file. + + CCE-84017-3 + + + - + - - Limit Privileged Container Use - Containers should be limited to only the privileges required -to run. To prevent containers from running as privileged containers, -the appropriate Security Context Constraints (SCCs) should set -allowPrivilegedContainer to false. + + Verify User Who Owns The OpenShift etcd Data Directory + To properly set the owner of /var/lib/etcd, run the command: $ sudo chown root /var/lib/etcd + 1.1.12 + The /var/lib/etcd directory contains highly-avaliable distributed key/value data storage +across an OpenShift cluster. Allowing access to users to this directory could compromise OpenShift +data and the cluster. + + + + + + + + + Verify Permissions on the OpenShift Container Network Interface Files + +To properly set the permissions of /etc/cni/net.d/*, run the command: +$ sudo chmod 0644 /etc/cni/net.d/* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.1 - Privileged containers have access to all Linux Kernel -capabilities and devices. If a privileged container were -compromised, an attacker would have full access to the container -and host. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83379-8 + + + - + - - Limit Access to the Host Process ID Namespace - Containers should not be allowed access to the host's process -ID namespace. To prevent containers from getting access to a host's -process ID namespace, the appropriate Security Context Constraints (SCCs) -should set allowHostPID to false. + + Verify Permissions on the OpenShift Controller Manager Kubeconfig File + +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig, run the command: +$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig + This rule is only applicable for nodes that run the Kubernetes Controller Manager service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.2 - A container running in the host's PID namespace can inspect -processes running outside the container which can be used to -escalate privileges outside of the container. + 1.1.17 + The Controller Manager's kubeconfig contains information about how the +component will access the API server. You should restrict its file +permissions to maintain the integrity of the file. The file should be +writable by only the administrators on the system. + + CCE-83604-9 + + + - + - - Limit Container Running As Root User - Containers should be limited to only the privileges required -to run and should very rarely be run as root user. To prevent -containers from running as root user, -the appropriate Security Context Constraints (SCCs) should set -allowPrivilegedContainer to false. + + Verify Permissions on the Etcd Database Directory + +To properly set the permissions of /var/lib/etcd, run the command: +$ sudo chmod 0700 /var/lib/etcd + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.2.6 - Privileged containers have access to all Linux Kernel -capabilities and devices. If a privileged container were -compromised, an attacker would have full access to the container -and host. + 1.1.11 + etcd is a highly-available key-value store used by Kubernetes deployments for persistent +storage of all of its REST API objects. This data directory should be protected from any +unauthorized reads or writes. It should not be readable or writable by any group members +or the world. + + CCE-84013-2 + + + - + - - - OpenShift - Kubernetes - Scheduler Settings - Contains evaluations for kube-scheduler configuration settings. - - Kube scheduler config filter - Kube scheduler filter - [.data."pod.yaml"] - - - Kube scheduler config file path - Kube scheduler config file path - /api/v1/namespaces/openshift-kube-scheduler/configmaps/kube-scheduler-pod - - - Ensure that the bind-address parameter is not used - The Scheduler API service which runs on port 10251/TCP by default is used for -health and metrics information and is available without authentication or -encryption. As such it should only be bound to a localhost interface, to -minimize the cluster's attack surface. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -{{.var_scheduler_filepath}} - API endpoint, filter with with the jq utility using the following filter - {{.var_scheduler_argument_filter}} - and persist it to the local - /api/v1/namespaces/openshift-kube-scheduler/configmaps/kube-scheduler-pod#569895645b4f9b87d4e21ab3c6fe4cc03627259826715e5043d5d8889c6c12d3 - file. - - CIP-003-8 R4.2 + + Verify Permissions on the Etcd Write-Ahead-Log Files + +To properly set the permissions of /var/lib/etcd/member/wal/*, run the command: +$ sudo chmod 0600 /var/lib/etcd/member/wal/* + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 - CIP-007-3 R5.1 CIP-007-3 R6.1 CM-6 CM-6(1) - SC-8 - SC-8(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 1.4.2 - In OpenShift 4, The Kubernetes Scheduler operator manages and updates the -Kubernetes Scheduler deployed on top of OpenShift. By default, the operator -exposes metrics via metrics service. The metrics are collected from the -Kubernetes Scheduler operator. Profiling data is sent to healthzPort, -the port of the localhost healthz endpoint. Changing this value may disrupt -components that monitor the kubelet health. - CCE-83674-2 - - - - - - - - - - Ensure that the port parameter is zero - The Scheduler API service which runs on port 10251/TCP by default is used for -health and metrics information and is available without authentication or -encryption. As such it should only be bound to a localhost interface, to -minimize the cluster's attack surface. - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the following: -{{.var_scheduler_filepath}} - API endpoint, filter with with the jq utility using the following filter - {{.var_scheduler_argument_filter}} - and persist it to the local - /api/v1/namespaces/openshift-kube-scheduler/configmaps/kube-scheduler-pod#569895645b4f9b87d4e21ab3c6fe4cc03627259826715e5043d5d8889c6c12d3 - file. - - 1.4.2 - In OpenShift 4, The Kubernetes Scheduler operator manages and updates the -Kubernetes Scheduler deployed on top of OpenShift. By default, the operator -exposes metrics via metrics service. The metrics are collected from the -Kubernetes Scheduler operator. Profiling data is sent to healthzPort, -the port of the localhost healthz endpoint. Changing this value may disrupt -components that monitor the kubelet health. + 1.1.11 + etcd is a highly-available key-value store used by Kubernetes deployments for persistent +storage of all of its REST API objects. This data directory should be protected from any +unauthorized reads or writes. It should not be readable or writable by any group members +or the world. + + CCE-83382-2 - - + - + - - - Kubernetes Secrets Management - Secrets let you store and manage sensitive information, -such as passwords, OAuth tokens, and ssh keys. -Such information might otherwise be put in a Pod -specification or in an image. - - Consider external secret storage - Consider the use of an external secrets storage and management system, -instead of using Kubernetes Secrets directly, if you have more complex -secret management needs. Ensure the solution requires authentication to -access secrets, has auditing of access to and use of secrets, and encrypts -secrets. Some solutions also make it easier to rotate secrets. + + Verify Permissions on the Etcd Member Pod Specification File + +To properly set the permissions of /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml, run the command: +$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/etcd-pod-*/etcd-pod.yaml + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.4.2 - Kubernetes supports secrets as first-class objects, but care needs to be -taken to ensure that access to secrets is carefully limited. Using an -external secrets provider can ease the management of access to secrets, -especially where secrets are used across both Kubernetes and non-Kubernetes -environments. + 1.1.7 + The etcd pod specification file controls various parameters that +set the behavior of the etcd service in the master node. etcd is a +highly-available key-value store which Kubernetes uses for persistent +storage of all of its REST API object. You should restrict its file +permissions to maintain the integrity of the file. The file should be +writable by only the administrators on the system. + + CCE-83973-8 + + + - + - - Do Not Use Environment Variables with Secrets - Secrets should be mounted as data volumes instead of environment -variables. + + Verify Permissions on the Etcd PKI Certificate Files + +To properly set the permissions of /etc/kubernetes/static-pod-resources/etcd-*/secrets/*/*.crt, run the command: +$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/etcd-*/secrets/*/*.crt + This rule is only applicable for nodes that run the Etcd service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 5.4.1 - Environment variables are subject and very susceptible to -malicious hijacking methods by an adversary, as such, -environment variables should never be used for secrets. + 1.1.20 + OpenShift makes use of a number of certificate files as part of the operation +of its components. The permissions on these files should be set to +600 or more restrictive to protect their integrity. + + CCE-83362-4 + + + - + - - - Kubernetes - Worker Node Settings - Contains evaluations for the worker node configuration settings. - - Verify Group Who Owns The Kubelet Configuration File - To properly set the group owner of /etc/kubernetes/kubelet.conf, run the command: $ sudo chgrp root /etc/kubernetes/kubelet.conf + + Verify Permissions on the OpenShift SDN Container Network Interface Plugin IP Address Allocations + +To properly set the permissions of /var/lib/cni/networks/openshift-sdn/*, run the command: +$ sudo chmod 0644 /var/lib/cni/networks/openshift-sdn/* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14655,55 +16341,58 @@ environment variables should never be used for secrets. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.6 - The kubelet configuration file contains information about the configuration of the -OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-84233-6 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83469-7 - + - + - - Verify Group Who Owns The Worker Proxy Kubeconfig File - To ensure the Kubernetes ConfigMap is mounted into the sdn daemonset pods with the -correct ownership, make sure that the sdn-config ConfigMap is mounted using -a ConfigMap at the /config mount point and that the sdn container -points to that configuration using the --proxy-config command line option. -Run: - oc get -nopenshift-sdn ds sdn -ojson | jq -r '.spec.template.spec.containers[] | select(.name == "sdn")' -and ensure the --proxy-config parameter points to -/config/kube-proxy-config.yaml and that the config mount point is -mounted from the sdn-config ConfigMap. + + Verify Permissions on the Kubernetes API Server Pod Specification File + +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml, run the command: +$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-apiserver-pod-*/kube-apiserver-pod.yaml + This rule is only applicable for nodes that run the Kubernetes API Server service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.4 - The kubeconfig file for kube-proxy provides permissions to the kube-proxy service. -The proxy kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - -The file is provided via a ConfigMap mount, so the kubelet itself makes sure that the -file permissions are appropriate for the container taking it into use. - + 1.1.1 + If the Kubernetes specification file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the configuration of +the Kubernetes API server that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83983-7 + + + - + - - Verify Group Who Owns the Worker Certificate Authority File - To properly set the group owner of /etc/kubernetes/kubelet-ca.crt, run the command: $ sudo chgrp root /etc/kubernetes/kubelet-ca.crt + + Verify Permissions on the Kubernetes Controller Manager Pod Specificiation File + +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml, run the command: +$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml + This rule is only applicable for nodes that run the Kubernetes Controller Manager service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14712,22 +16401,56 @@ file permissions are appropriate for the container taking it into use.SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.8 - The worker certificate authority file contains the certificate authority -certificate for an OpenShift node that is configured on the system. Protection of this file is + 1.1.3 + If the Kubernetes specification file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the configuration of +an Kubernetes Controller Manager server that is configured on the system. Protection of this file is critical for OpenShift security. - - CCE-83440-8 + + CCE-84161-9 - + - + - - Verify Group Who Owns The Worker Kubeconfig File - To properly set the group owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chgrp root /var/lib/kubelet/kubeconfig + + Verify Permissions on the Kube Scheduler Pod Specification File + +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod.yaml, run the command: +$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod.yaml + 1.1.5 + If the Kube specification file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the configuration of +an OpenShift scheduler that is configured on the system. Protection of this file is +critical for OpenShift security. + + + + + + Verify Permissions on the OpenShift Admin Kubeconfig File + +To properly set the permissions of /etc/kubernetes/kubeconfig, run the command: +$ sudo chmod 0600 /etc/kubernetes/kubeconfig + 1.1.13 + If the /etc/kubernetes/kubeconfig file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the administration configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + + + + + + Verify Permissions on the OpenShift Admin Kubeconfig Files + +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig, run the command: +$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig + This rule is only applicable for nodes that run the Kubernetes Control Plane. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14736,24 +16459,28 @@ critical for OpenShift security. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.10 - The worker kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83409-3 + 1.1.13 + There are various kubeconfig files that can be used by the administrator, +defining various settings for the administration of the cluster. These files +contain credentials that can be used to control the cluster and are needed +for disaster recovery and each kubeconfig points to a different endpoint in +the cluster. You should restrict its file permissions to maintain the +integrity of the kubeconfig file as an attacker who gains access to these +files can take over the cluster. + + CCE-84278-1 - + - + - - Verify Group Who Owns The OpenShift Node Service File - ' - To properly set the group owner of /etc/systemd/system/kubelet.service, run the command: - $ sudo chgrp root /etc/systemd/system/kubelet.service' + + Verify Permissions on the OpenShift Multus Container Network Interface Plugin Files + +To properly set the permissions of /var/run/multus/cni/net.d/*, run the command: +$ sudo chmod 0644 /var/run/multus/cni/net.d/* CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14762,23 +16489,28 @@ critical for OpenShift security. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.2 - The /etc/systemd/system/kubelet.service -file contains information about the configuration of the -OpenShift node service that is configured on the system. Protection of this file is -critical for OpenShift security. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. - CCE-83975-3 + CCE-83467-1 - + - + - - Verify User Who Owns The Kubelet Configuration File - To properly set the owner of /var/lib/kubelet/config.json, run the command: $ sudo chown root /var/lib/kubelet/config.json + + Verify Permissions on the OpenShift PKI Certificate Files + +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-*/secrets/*/tls.crt, run the command: +$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/kube-*/secrets/*/tls.crt + This rule is only applicable for nodes that run the Kubernetes Control Plane. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14787,22 +16519,83 @@ critical for OpenShift security. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.6 - The kubelet configuration file contains information about the configuration of the -OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-85900-9 + 1.1.20 + OpenShift makes use of a number of certificate files as part of the operation +of its components. The permissions on these files should be set to +600 or more restrictive to protect their integrity. + + CCE-83552-0 - + - + - - Verify User Who Owns The Kubelet Configuration File - To properly set the owner of /etc/kubernetes/kubelet.conf, run the command: $ sudo chown root /etc/kubernetes/kubelet.conf + + Verify Permissions on the OpenShift PKI Private Key Files + +To properly set the permissions of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command: +$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/*/*/*/*.key + This rule is only applicable for nodes that run the Kubernetes Control Plane. +The aforementioned service is only running on the nodes labeled +"master" by default. + CIP-003-8 R1.3 + CIP-003-8 R3 + CIP-003-8 R3.1 + CIP-003-8 R3.2 + CIP-003-8 R3.3 + CIP-003-8 R5.1.1 + CIP-003-8 R5.3 + CIP-004-6 R2.2.3 + CIP-004-6 R2.3 + CIP-007-3 R5.1 + CIP-007-3 R5.1.2 + CIP-007-3 R5.2 + CIP-007-3 R5.3.1 + CIP-007-3 R5.3.2 + CIP-007-3 R5.3.3 + CM-6 + CM-6(1) + IA-5(2) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.1.21 + OpenShift makes use of a number of key files as part of the operation of its +components. The permissions on these files should be set to 600 +to protect their integrity and confidentiality. + + CCE-83580-1 + + + + + + + + + Verify Permissions on the OpenShift Open vSwitch Files + +To properly set the permissions of /etc/openvswitch/.*, run the command: +$ sudo chmod 0644 /etc/openvswitch/.* + 1.4.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + + + + + + + + Verify Permissions on the Open vSwitch Configuration Database + +To properly set the permissions of /etc/openvswitch/conf.db, run the command: +$ sudo chmod 0640 /etc/openvswitch/conf.db CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14811,55 +16604,52 @@ critical for OpenShift security. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.6 - The kubelet configuration file contains information about the configuration of the -OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. - CCE-83976-1 + CCE-83788-0 - + - + - - Verify User Who Owns The Worker Proxy Kubeconfig File - To ensure the Kubernetes ConfigMap is mounted into the sdn daemonset pods with the -correct ownership, make sure that the sdn-config ConfigMap is mounted using -a ConfigMap at the /config mount point and that the sdn container -points to that configuration using the --proxy-config command line option. -Run: - oc get -nopenshift-sdn ds sdn -ojson | jq -r '.spec.template.spec.containers[] | select(.name == "sdn")' -and ensure the --proxy-config parameter points to -/config/kube-proxy-config.yaml and that the config mount point is -mounted from the sdn-config ConfigMap. + + Verify Permissions on the Open vSwitch Configuration Database Lock + +To properly set the permissions of /etc/openvswitch/.conf.db.~lock~, run the command: +$ sudo chmod 0600 /etc/openvswitch/.conf.db.~lock~ CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.4 - The kubeconfig file for kube-proxy provides permissions to the kube-proxy service. -The proxy kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - -The file is provided via a ConfigMap mount, so the kubelet itself makes sure that the -file permissions are appropriate for the container taking it into use. - + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-84202-1 + + + - + - - Verify User Who Owns the Worker Certificate Authority File - To properly set the owner of /etc/kubernetes/kubelet-ca.crt, run the command: $ sudo chown root /etc/kubernetes/kubelet-ca.crt + + Verify Permissions on the Open vSwitch Process ID File + +To properly set the permissions of /var/run/openvswitch/ovs-vswitchd.pid, run the command: +$ sudo chmod 0644 /var/run/openvswitch/ovs-vswitchd.pid CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14868,22 +16658,25 @@ file permissions are appropriate for the container taking it into use.SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.8 - The worker certificate authority file contains the certificate authority -certificate for an OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. - CCE-83495-2 + CCE-83666-8 - + - + - - Verify User Who Owns The Worker Kubeconfig File - To properly set the owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chown root /var/lib/kubelet/kubeconfig + + Verify Permissions on the Open vSwitch Persistent System ID + +To properly set the permissions of /etc/openvswitch/system-id.conf, run the command: +$ sudo chmod 0644 /etc/openvswitch/system-id.conf CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14892,24 +16685,25 @@ critical for OpenShift security. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.10 - The worker kubeconfig file contains information about the administrative configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. - CCE-83408-5 + CCE-83400-2 - + - + - - Verify User Who Owns The OpenShift Node Service File - ' - To properly set the owner of /etc/systemd/system/kubelet.service, run the command: - $ sudo chown root /etc/systemd/system/kubelet.service ' + + Verify Permissions on the Open vSwitch Daemon PID File + +To properly set the permissions of /run/openvswitch/ovs-vswitchd.pid, run the command: +$ sudo chmod 0644 /run/openvswitch/ovs-vswitchd.pid CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14918,25 +16712,25 @@ critical for OpenShift security. SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.2 - The /etc/systemd/system/kubelet.service -file contains information about the configuration of the -OpenShift node service that is configured on the system. Protection of this file is -critical for OpenShift security. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. - CCE-84193-2 + CCE-83710-4 - + - + - - Verify Permissions on The Kubelet Configuration File + + Verify Permissions on the Open vSwitch Database Server PID -To properly set the permissions of /var/lib/kubelet/config.json, run the command: -$ sudo chmod 0600 /var/lib/kubelet/config.json +To properly set the permissions of /run/openvswitch/ovsdb-server.pid, run the command: +$ sudo chmod 0644 /run/openvswitch/ovsdb-server.pid CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14945,25 +16739,28 @@ To properly set the permissions of /var/lib/kubelet/config.jsonSRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.5 - If the kubelet configuration file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the configuration of -an OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. - CCE-85896-9 + CCE-83679-1 - + - + - - Verify Permissions on The Kubelet Configuration File + + Verify Permissions on the Kubernetes Scheduler Pod Specification File -To properly set the permissions of /etc/kubernetes/kubelet.conf, run the command: -$ sudo chmod 0644 /etc/kubernetes/kubelet.conf +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command: +$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml + This rule is only applicable for nodes that run the Kubernetes Scheduler service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -14972,71 +16769,71 @@ To properly set the permissions of /etc/kubernetes/kubelet.confSRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.5 - If the kubelet configuration file is writable by a group-owner or the + 1.1.5 + If the Kubernetes specification file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the configuration of -an OpenShift node that is configured on the system. Protection of this file is +an Kubernetes Scheduler service that is configured on the system. Protection of this file is critical for OpenShift security. - - CCE-83470-5 + + CCE-84057-9 - + - + - - Verify Permissions on the Worker Proxy Kubeconfig File - To ensure the Kubernetes ConfigMap is mounted into the sdn daemonset pods with the -correct permissions, make sure that the sdn-config ConfigMap is mounted using -restrictive permissions. Check that the config VolumeMount mounts the -sdn-config configMap with permissions set to 420: - -{ -"configMap": { - "defaultMode": 420, - "name": "sdn-config" - }, -"name": "config" -} - - This rule's check operates on the cluster configuration dump. -Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn API endpoint to the local /apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn file. + + Verify Permissions on the Kubernetes Scheduler Kubeconfig File + +To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig, run the command: +$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig + This rule is only applicable for nodes that run the Kubernetes Scheduler service. +The aforementioned service is only running on the nodes labeled +"master" by default. CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) - Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.3 - The kube-proxy kubeconfig file controls various parameters of the kube-proxy -service in the worker node. If used, you should restrict its file permissions -to maintain the integrity of the file. The file should be writable by only -the administrators on the system. - -The kube-proxy runs with the kubeconfig parameters configured as -a Kubernetes ConfigMap instead of a file. In this case, there is no proxy -kubeconfig file. But appropriate permissions still need to be set in the -ConfigMap mount. - - CCE-84047-0 + 1.1.15 + The kubeconfig for the Scheduler contains paramters for the scheduler +to access the Kube API. You should restrict its file permissions to maintain +the integrity of the file. The file should be writable by only the +administrators on the system. + + CCE-83772-4 - - + - + - - Verify Permissions on the Worker Certificate Authority File + + The OpenShift etcd Data Directory Must Have Mode 0700 -To properly set the permissions of /etc/kubernetes/kubelet-ca.crt, run the command: -$ sudo chmod 0644 /etc/kubernetes/kubelet-ca.crt +To properly set the permissions of /var/lib/etcd, run the command: +$ sudo chmod 0700 /var/lib/etcd + 1.1.11 + The /var/lib/etcd directory contains highly-avaliable distributed key/value data storage +across an OpenShift cluster. Allowing access to users to this directory could compromise OpenShift +data and the cluster. + + + + + + + + + Verify Permissions on the OpenShift SDN CNI Server Config + +To properly set the permissions of /var/run/openshift-sdn/cniserver/config.json, run the command: +$ sudo chmod 0444 /var/run/openshift-sdn/cniserver/config.json CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 @@ -15045,3518 +16842,5879 @@ To properly set the permissions of /etc/kubernetes/kubelet-ca.crtSRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.7 - If the worker certificate authority file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the certificate authority -certificate for an OpenShift node that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83493-7 + 1.1.9 + CNI (Container Network Interface) files consist of a specification and libraries for +writing plugins to configure network interfaces in Linux containers, along with a number +of supported plugins. Allowing writeable access to the files could allow an attacker to modify +the networking configuration potentially adding a rogue network connection. + + CCE-83927-4 - + - + - - Verify Permissions on the Worker Kubeconfig File + + + Kubernetes - Network Configuration and Firewalls + Most systems must be connected to a network of some +sort, and this brings with it the substantial risk of network +attack. This section discusses the security impact of decisions +about networking which must be made when configuring a system. + +This section also discusses firewalls, network access +controls, and other network security frameworks, which allow +system-level rules to be written that can limit an attackers' ability +to connect to your system. These rules can specify that network +traffic should be allowed or denied from certain IP addresses, +hosts, and networks. The rules can also specify which of the +system's network services are available to particular hosts or +networks. + + Ensure that cluster-wide proxy is set -To properly set the permissions of /var/lib/kubelet/kubeconfig, run the command: -$ sudo chmod 0600 /var/lib/kubelet/kubeconfig + +Production environments can deny direct access to the Internet and instead have +an HTTP or HTTPS proxy available. + + +The Proxy object is used to manage the cluster-wide egress proxy. Setting this +will ensure that containers get the appropriate environment variables set +to ensure traffic goes to the proxy per organizational requirements. + + +For more information, see the relevant documentation. + + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/proxies/cluster API endpoint to the local /apis/config.openshift.io/v1/proxies/cluster file. + CIP-004-6 R2.2.4 + CIP-004-6 R3 + CIP-007-3 R5.1 + CIP-007-3 R6.1 + SC-7(8) + External networks tend to be outside of organizational control. By ensuring +that egress traffic goes through an authorized proxy, one is able to ensure +that expected and safe traffic is coming out, and malicious actors +aren't leaking sensitive information, or calling back from a central command +center to get further instructions upon intrusion. + CCE-90765-9 + + + + + + + Ensure that the CNI in use supports Network Policies + There are a variety of CNI plugins available for Kubernetes. If the CNI in +use does not support Network Policies it may not be possible to effectively +restrict traffic in the cluster. OpenShift supports Kubernetes NetworkPolicy +using a Kubernetes Container Network Interface (CNI) plug-in. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/operator.openshift.io/v1/networks/cluster + API endpoint, filter with with the jq utility using the following filter + [.spec.defaultNetwork.type] + and persist it to the local + /apis/operator.openshift.io/v1/networks/cluster#35e33d6dc1252a03495b35bd1751cac70041a511fa4d282c300a8b83b83e3498 + file. + CIP-003-8 R6 CIP-004-6 R3 CIP-007-3 R6.1 CM-6 CM-6(1) + Req-1.1.4 + Req-1.2 + Req-2.2 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.9 - If the worker kubeconfig file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the administration configuration of the -OpenShift cluster that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83509-0 + SRG-APP-000038-CTR-000105 + SRG-APP-000039-CTR-000110 + 5.3.1 + Kubernetes network policies are enforced by the CNI plugin in use. As such +it is important to ensure that the CNI plugin supports both Ingress and +Egress network policies. - + + - + - - Verify Permissions on the OpenShift Node Service File - -To properly set the permissions of /etc/systemd/system/kubelet.service, run the command: -$ sudo chmod 0644 /etc/systemd/system/kubelet.service + + Ensure that application Namespaces have Network Policies defined. + Use network policies to isolate traffic in your cluster network. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/networking.k8s.io/v1/networkpolicies + API endpoint, filter with with the jq utility using the following filter + [.items[] | select((.metadata.namespace | startswith("openshift") | not) and (.metadata.namespace | startswith("kube-") | not) and .metadata.namespace != "default") | .metadata.namespace] | unique + and persist it to the local + /apis/networking.k8s.io/v1/networkpolicies#51742b3e87275db9eb7fc6c0286a9e536178a2a83e3670b615ceaf545e7fd300 + file. + /api/v1/namespaces + API endpoint, filter with with the jq utility using the following filter + [.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default")] + and persist it to the local + /api/v1/namespaces#34d4beecc95c65d815d9d48fd4fdcb0c521631852ad088ef74e36d012b0e1e0d + file. + + CIP-003-8 R4 + CIP-003-8 R4.2 + CIP-003-8 R5 CIP-003-8 R6 + CIP-004-6 R2.2.4 CIP-004-6 R3 + CIP-007-3 R2 + CIP-007-3 R2.1 + CIP-007-3 R2.2 + CIP-007-3 R2.3 + CIP-007-3 R5.1 CIP-007-3 R6.1 + AC-4 + AC-4(21) + CA-3(5) CM-6 CM-6(1) + CM-7 + CM-7(1) + SC-7 + SC-7(3) + SC-7(5) + SC-7(8) + SC-7(12) + SC-7(13) + SC-7(18) + SC-7(10) + SI-4(22) + Req-1.1.4 + Req-1.2 + Req-1.2.1 + Req-1.3.1 + Req-1.3.2 + Req-2.2 + SRG-APP-000038-CTR-000105 + SRG-APP-000039-CTR-000110 + SRG-APP-000141-CTR-000315 + SRG-APP-000141-CTR-000320 + SRG-APP-000142-CTR-000325 + SRG-APP-000142-CTR-000330 SRG-APP-000516-CTR-001325 SRG-APP-000516-CTR-001330 SRG-APP-000516-CTR-001335 - 4.1.1 - If the /etc/systemd/system/kubelet.service -file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the service configuration of the -OpenShift node service that is configured on the system. Protection of this file is -critical for OpenShift security. - - CCE-83455-6 + SRG-APP-000645-CTR-001410 + 5.3.2 + Running different applications on the same Kubernetes cluster creates a risk of one +compromised application attacking a neighboring application. Network segmentation is +important to ensure that containers can communicate only with those they are supposed +to. When a network policy is introduced to a given namespace, all traffic not allowed +by the policy is denied. However, if there are no network policies in a namespace all +traffic will be allowed into and out of the pods in that namespace. - + + - + + + + + Ensure that the default Ingress CA (wildcard issuer) has been replaced + Check that the default Ingress CA has been replaced. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/proxies/cluster API endpoint to the local /apis/config.openshift.io/v1/proxies/cluster file. + CIP-007-3 R5.1 + SC-17 + OpenShift auto-generates several PKIs to serve TLS on different +endpoints of the system. It is possible and necessary to configure a +custom PKI which allows external clients to trust the endpoints. + +The Ingress Operator is the component responsible for enabling external +access to OpenShift Container Platform cluster services. The aforementioned +operator creates an internal CA and issues a wildcard certificate that is +valid for applications under the .apps sub-domain. Both the web console +and CLI use this certificate as well. The certificate and key would need +to be replaced since a certificate coming from a trusted provider is +needed. + + + https://docs.openshift.com/container-platform/latest/security/certificates/replacing-default-ingress-certificate.html + + + + + + + + + + Ensure that the default Ingress certificate has been replaced + Check that the default Ingress certificate has been replaced. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default API endpoint to the local /apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default file. + SC-12 + OpenShift auto-generates several PKIs to serve TLS on different +endpoints of the system. It is possible and necessary to configure a +custom PKI which allows external clients to trust the endpoints. + +The Ingress Operator is the component responsible for enabling external +access to OpenShift Container Platform cluster services. The aforementioned +operator creates an internal CA and issues a wildcard certificate that is +valid for applications under the .apps sub-domain. Both the web console +and CLI use this certificate as well. The certificate and key would need +to be replaced since a certificate coming from a trusted provider is +needed. + + + https://docs.openshift.com/container-platform/latest/security/certificates/replacing-default-ingress-certificate.html + + + + + + + + + + Ensure that all Routes has rate limit enabled + OpenShift has an option to set the IP whitelist for Routes [1] when +creating new Routes. All routes outside the openshift namespaces and +the kube namespaces should use the IP whitelist annotations. Requests +from IP addresses that are not in the whitelist are dropped. + +[1] https://docs.openshift.com/container-platform/latest/networking/routes/route-configuration.html#nw-route-specific-annotations_route-configuration + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/route.openshift.io/v1/routes?limit=500 + API endpoint, filter with with the jq utility using the following filter + [.items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.annotations["haproxy.router.openshift.io/ip_whitelist"] | not) | .metadata.name] + and persist it to the local + /apis/route.openshift.io/v1/routes?limit=500#aec152a4446d7917fcbebee892a2ec3fbdef3b71cc0784c9457b2e54fd64dd3b + file. + + SC-7(5) + The usage of IP whitelist for Routes provides basic protection against unwanted access. + CCE-90596-8 + + + + + + + + + + Ensure that all OpenShift Routes prefer TLS + OpenShift Container Platform provides methods for communicating from +outside the cluster with services running in the cluster. TLS must +be used to protect these communications. OpenShift +Routes provide the ability to configure the needed TLS settings. With +these, one is able to configure that any request coming from the outside +must use TLS. To verify this, ensure that every Route in the system +has a policy of Disable or Redirect to ensure a +secure endpoint is used. The aforementioned policy will be set in +a Routes .spec.tls.insecureEdgeTerminationPolicy setting. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/route.openshift.io/v1/routes?limit=500 API endpoint to the local /apis/route.openshift.io/v1/routes?limit=500 file. + CIP-003-8 R4 + CIP-003-8 R4.2 + CIP-003-8 R5 + CIP-004-6 R3 + CIP-007-3 R5.1 + CIP-007-3 R7.1 + AC-4 + AC-4(21) + AC-17(3) + SC-8 + SC-8(1) + SC-8(2) + SI-4 + Req-6.5.4 + SRG-APP-000038-CTR-000105 + SRG-APP-000039-CTR-000110 + SRG-APP-000441-CTR-001090 + SRG-APP-000442-CTR-001095 + Using clear-text in communications coming to or from outside +the cluster's network may leak sensitive information. + CCE-84225-2 + + + + + + + + + + Ensure that all Routes has rate limit enabled + OpenShift has an option to set the rate limit for Routes [1] when creating new Routes. +All routes outside the openshift namespaces and the kube namespaces should use the +rate-limiting annotations. + +[1] https://docs.openshift.com/container-platform/4.9/networking/routes/route-configuration.html#nw-route-specific-annotations_route-configuration + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/route.openshift.io/v1/routes?limit=500 + API endpoint, filter with with the jq utility using the following filter + [.items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | .metadata.name] + and persist it to the local + /apis/route.openshift.io/v1/routes?limit=500#842fa6716f17342d62e70f2755db709b9d7a161cf0338ea8bfae9b06dab5e6cc + file. + + SC-5 + SC-5(1) + SC-5(2) + SRG-APP-000246-CTR-000605 + SRG-APP-000435-CTR-001070 + The usage of rate limit for Routes provides basic protection against distributed denial-of-service (DDoS) attacks. + CCE-90779-0 + + + + + + - - - - - - - combine_ovals.py from SCAP Security Guide - ssg: [0, 1, 64], python: 3.10.6 - 5.11 - 2022-08-11T18:54:56 - - - + + OpenShift API Server + This section contains recommendations for openshift-apiserver configuration. + + Configure the Audit Log Path + To enable auditing on the OpenShift API Server, the audit log path must be set. +Edit the openshift-apiserver configmap +and set the audit-log-path to a suitable path and file +where audit logs should be written. For example: + +"apiServerArguments":{ + ... + "audit-log-path":"/var/log/openshift-apiserver/audit.log", + ... + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /api/v1/namespaces/openshift-apiserver/configmaps/config API endpoint to the local /api/v1/namespaces/openshift-apiserver/configmaps/config file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.2.22 + Auditing of the API Server is not enabled by default. Auditing the API Server +provides a security-relevant chronological set of records documenting the sequence +of activities that have affected the system by users, administrators, or other +system components. + CCE-83547-0 + + + + + + + + + + + Role-based Acess Control + Role-based access control (RBAC) objects determine +whether a user is allowed to perform a given action +within a project. + +Cluster administrators can use the cluster roles and +bindings to control who has various access levels to +the OpenShift Container Platform platform itself +and all projects. + +Developers can use local roles and bindings to control +who has access to their projects. Note that authorization +is a separate step from authentication, which is more +about determining the identity of who is taking the action. + + Ensure cluster roles are defined in the cluster + + +RBAC is a critical feature in terms of security for Kubernetes and +OpenShift. It enables administrators to segment the privileges +granted to a service account, and thus allows us to limit the +access to resources that they get. By defining cluster roles appropriately +one is able to codify organizational policy. [1] + + +[1] + https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html + + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/rbac.authorization.k8s.io/v1/clusterroles?limit=1000 API endpoint to the local /apis/rbac.authorization.k8s.io/v1/clusterroles?limit=1000 file. + Req-7.1.1 + By defining RBAC cluster roles, one is able to limit the permissions +given to a Service Account, and thus limit the blast radius +that an account compromise would have. + CCE-86595-6 + + + + + + + Profiling is protected by RBAC + Ensure that the cluster-debugger cluster role includes the /debug/pprof +resource URL. This demonstrates that profiling is protected by RBAC, with a +specific cluster role to allow access. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger API endpoint to the local /apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.3.2 + 1.4.1 + Profiling allows for the identification of specific performance bottlenecks. +It generates a significant amount of program data that could potentially be +exploited to uncover system and program details. If you are not experiencing +any bottlenecks and do not need the profiler for troubleshooting purposes, it +is recommended to turn it off to reduce the potential attack surface. To +ensure the collected data is not exploited, profiling endpoints are secured +via RBAC (see cluster-debugger role). By default, the profiling endpoints are +accessible only by users bound to cluster-admin or cluster-debugger role. +Profiling can not be disabled. + CCE-84182-5 + + + + + + + + + + Ensure that the cluster-admin role is only used where required + The RBAC role cluster-admin provides wide-ranging powers over the +environment and should be used only where and when needed. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + Req-7.1.2 + Req-10.5.1 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.1.1 + Kubernetes provides a set of default roles where RBAC is used. Some of these +roles such as cluster-admin provide wide-ranging privileges which should +only be applied where absolutely necessary. Roles such as cluster-admin +allow super-user access to perform any action on any resource. When used in +a ClusterRoleBinding, it gives full control over every resource in the +cluster and in all namespaces. When used in a RoleBinding, it gives full +control over every resource in the rolebinding's namespace, including the +namespace itself. + + + + + + Limit Access to Kubernetes Secrets + The Kubernetes API stores secrets, which may be service +account tokens for the Kubernetes API or credentials used +by workloads in the cluster. Access to these secrets should +be restricted to the smallest possible group of users to +reduce the risk of privilege escalation. To restrict users from +secrets, remove get, list, and watch +access to unauthorized users to secret objects in the cluster. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.1.2 + Inappropriate access to secrets stored within the Kubernetes +cluster can allow for an attacker to gain additional access to +the Kubernetes cluster or external resources whose credentials +are stored as secrets. + + + + + + Minimize Access to Pod Creation + The ability to create pods in a namespace can provide a +number of opportunities for privilege escalation. Where +applicable, remove create access to pod +objects in the cluster. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.1.4 + The ability to create pods in a cluster opens up the cluster +for privilege escalation. + + + + + + Ensure roles are defined in the cluster + + +RBAC is a critical feature in terms of security for Kubernetes and +OpenShift. It enables administrators to segment the privileges +granted to a service account, and thus allows us to limit the +access to resources that they get. By defining roles appropriately +one is able to codify organizational policy. [1] + + +[1] + https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html + + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/rbac.authorization.k8s.io/v1/roles?limit=1000 API endpoint to the local /apis/rbac.authorization.k8s.io/v1/roles?limit=1000 file. + Req-7.1.1 + By defining RBAC roles, one is able to limit the permissions +given to a Service Account, and thus limit the blast radius +that an account compromise would have. + CCE-86588-1 + + + + + + + Minimize Wildcard Usage in Cluster and Local Roles + Kubernetes Cluster and Local Roles provide access to resources +based on sets of objects and actions that can be taken on +those objects. It is possible to set either of these using a +wildcard * which matches all items. This violates the +principle of least privilege and leaves a cluster in a more +vulnerable state to privilege abuse. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.1.3 + The principle of least privilege recommends that users are +provided only the access required for their role and nothing +more. The use of wildcard rights grants is likely to provide +excessive rights to the Kubernetes API. + + + + + + + Kubernetes - Registry Security Practices + Contains evaluations for Kubernetes registry security practices, and cluster-wide registry configuration. + + Allowed registries are configured + The configuration registrySources.allowedRegistries determines the +permitted registries that the OpenShift container runtime can access for builds +and pods. This configuration setting ensures that all registries other than +those specified are blocked. + +You can set the allowed repositories by applying the following manifest using +oc patch, e.g. if you save the following snippet to +/tmp/allowed-registries-patch.yaml + +spec: + registrySources: + allowedRegistries: + - my-trusted-registry.internal.example.com + you would call +oc patch image.config.openshift.io cluster --patch="$(cat /tmp/allowed-registries-patch.yaml)" --type=merge + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/images/cluster API endpoint to the local /apis/config.openshift.io/v1/images/cluster file. + CM-5(3) + CM-7(2) + CM-7(5) + CM-11 + SRG-APP-000131-CTR-000280 + SRG-APP-000131-CTR-000285 + SRG-APP-000384-CTR-000915 + Allowed registries should be configured to restrict the registries that the +OpenShift container runtime can access, and all other registries should be +blocked. + + + + + + + Allowed registries for import are configured + The configuration allowedRegistriesForImport limits the container +image registries from which normal users may import images. This is important +to control, as a user who can stand up a malicious registry can then import +content which claims to include the SHAs of legimitate content layers. +You can set the allowed repositories for import by applying the following +manifest using oc patch, e.g. if you save the following snippet to +/tmp/allowed-import-registries-patch.yaml + +spec: + allowedRegistriesForImport: + - domainName: my-trusted-registry.internal.example.com + insecure: false + you would call +oc patch image.config.openshift.io cluster --patch="$(cat /tmp/allowed-import-registries-patch.yaml)" --type=merge + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/config.openshift.io/v1/images/cluster API endpoint to the local /apis/config.openshift.io/v1/images/cluster file. + CM-5(3) + CM-7(2) + CM-7(5) + CM-11 + SRG-APP-000131-CTR-000280 + SRG-APP-000131-CTR-000285 + SRG-APP-000384-CTR-000915 + Allowed registries for import should be specified to limit the registries +from which users may import images. + + + + + + + + OpenShift - Risk Assessment Settings + Contains evaluations for the cluster's risk assessment configuration settings. + + Ensure that Compliance Operator is scanning the cluster + The Compliance Operator +scans the hosts and the platform (OCP) +configurations for software flaws and improper configurations according +to different compliance benchmarks. It uses OpenSCAP as a backend, +which is a known and certified tool to do such scans. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/compliance.openshift.io/v1alpha1/compliancesuites?limit=5 API endpoint to the local /apis/compliance.openshift.io/v1alpha1/compliancesuites?limit=5 file. + CIP-003-8 R1.3 + CIP-003-8 R4.3 + CIP-003-8 R6 + CIP-004-6 4.1 + CIP-004-6 4.2 + CIP-004-6 R3 + CIP-004-6 R4 + CIP-004-6 R4.2 + CIP-005-6 R1 + CIP-005-6 R1.1 + CIP-005-6 R1.2 + CIP-007-3 R3 + CIP-007-3 R3.1 + CIP-007-3 R6.1 + CIP-007-3 R8.4 + CM-6 + CM-6(1) + RA-5 + RA-5(5) + SA-4(8) + Req-2.2.4 + SRG-APP-000414-CTR-001010 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + Vulnerability scanning and risk management are important detective controls +for all systems, to detect potential flaws and unauthorised access. + CCE-83697-3 + + + + + + + + + + + Security Context Constraints (SCC) + Similar to the way that RBAC resources control user access, +administrators can use Security Context Constraints (SCCs) +to control permissions for pods. These permissions include +actions that a pod, a collection of containers, can perform +and what resources it can access. You can use SCCs to define +a set of conditions that a pod must run with in order to be +accepted into the system. + + Permitted SCCs with allowedCapabilities + A regular expression that lists all SCCs that are permitted to set the allowedCapabilities attribute + ^privileged$|^hostnetwork-v2$|^restricted-v2$|^nonroot-v2$ + + + Drop Container Capabilities + Containers should not enable more capabilites than needed as this +opens the door for malicious use. To disable the +capabilities, the appropriate Security Context Constraints (SCCs) +should set all capabilities as * or a list of capabilities in +requiredDropCapabilities. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.9 + By default, containers run with a default set of capabilities as assigned +by the Container Runtime which can include dangerous or highly privileged +capabilities. Capabilities should be dropped unless absolutely critical for +the container to run software as added capabilities that are not required +allow for malicious containers or attackers. + + + + + + Limit Container Capabilities + Containers should not enable more capabilites than needed as this +opens the door for malicious use. To enable only the +required capabilities, the appropriate Security Context Constraints (SCCs) +should set capabilities as a list in allowedCapabilities. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +/apis/security.openshift.io/v1/securitycontextconstraints + API endpoint, filter with with the jq utility using the following filter + [.items[] | select(.metadata.name | test("{{.var_sccs_with_allowed_capabilities_regex}}"; "") | not)] | map(.allowedCapabilities == null) + and persist it to the local + /apis/security.openshift.io/v1/securitycontextconstraints#395df9a25b06bd949effbff7e3071c03493e0dd679ee1c7bfcfcb35647e9328c + file. + + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.8 + By default, containers run with a default set of capabilities as assigned +by the Container Runtime which can include dangerous or highly privileged +capabilities. Capabilities should be dropped unless absolutely critical for +the container to run software as added capabilities that are not required +allow for malicious containers or attackers. + + + + + + + + + + Limit Access to the Host IPC Namespace + Containers should not be allowed access to the host's Interprocess Commication (IPC) +namespace. To prevent containers from getting access to a host's +IPC namespace, the appropriate Security Context Constraints (SCCs) +should set allowHostIPC to false. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.3 + A container running in the host's IPC namespace can use IPC +to interact with processes outside the container potentially +allowing an attacker to exploit a host process thereby enabling an +attacker to exploit other services. + CCE-84042-1 + + + + + + Limit Use of the CAP_NET_RAW + Containers should not enable more capabilites than needed as this +opens the door for malicious use. CAP_NET_RAW enables a container +to launch a network attack on another container or cluster. To disable the +CAP_NET_RAW capability, the appropriate Security Context Constraints (SCCs) +should set NET_RAW in requiredDropCapabilities. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.7 + By default, containers run with a default set of capabilities as assigned +by the Container Runtime which can include dangerous or highly privileged +capabilities. If the CAP_NET_RAW is enabled, it may be misused +by malicious containers or attackers. + + + + + + Limit Access to the Host Network Namespace + Containers should not be allowed access to the host's network +namespace. To prevent containers from getting access to a host's +network namespace, the appropriate Security Context Constraints (SCCs) +should set allowHostNetwork to false. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.4 + A container running in the host's network namespace could +access the host network traffic to and from other pods +potentially allowing an attacker to exploit pods and network +traffic. + CCE-83492-9 + + + + + + Limit Containers Ability to Escalate Privileges + Containers should be limited to only the privileges required +to run and should not be allowed to escalate their privileges. +To prevent containers from escalating privileges, +the appropriate Security Context Constraints (SCCs) +should set allowPrivilegeEscalation to false. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.5 + Privileged containers have access to more of the Linux Kernel +capabilities and devices. If a privileged container were +compromised, an attacker would have full access to the container +and host. + CCE-83447-3 + + + + + + Limit Privileged Container Use + Containers should be limited to only the privileges required +to run. To prevent containers from running as privileged containers, +the appropriate Security Context Constraints (SCCs) should set +allowPrivilegedContainer to false. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.1 + Privileged containers have access to all Linux Kernel +capabilities and devices. If a privileged container were +compromised, an attacker would have full access to the container +and host. + + + + + + Limit Access to the Host Process ID Namespace + Containers should not be allowed access to the host's process +ID namespace. To prevent containers from getting access to a host's +process ID namespace, the appropriate Security Context Constraints (SCCs) +should set allowHostPID to false. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.2 + A container running in the host's PID namespace can inspect +processes running outside the container which can be used to +escalate privileges outside of the container. + + + + + + Limit Container Running As Root User + Containers should be limited to only the privileges required +to run and should very rarely be run as root user. To prevent +containers from running as root user, +the appropriate Security Context Constraints (SCCs) should set +allowPrivilegedContainer to false. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.2.6 + Privileged containers have access to all Linux Kernel +capabilities and devices. If a privileged container were +compromised, an attacker would have full access to the container +and host. + + + + + + + OpenShift - Kubernetes - Scheduler Settings + Contains evaluations for kube-scheduler configuration settings. + + Kube scheduler config filter + Kube scheduler filter + [.data."pod.yaml"] + + + Kube scheduler config file path + Kube scheduler config file path + /api/v1/namespaces/openshift-kube-scheduler/configmaps/kube-scheduler-pod + + + Ensure that the bind-address parameter is not used + The Scheduler API service which runs on port 10251/TCP by default is used for +health and metrics information and is available without authentication or +encryption. As such it should only be bound to a localhost interface, to +minimize the cluster's attack surface. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +{{.var_scheduler_filepath}} + API endpoint, filter with with the jq utility using the following filter + {{.var_scheduler_argument_filter}} + and persist it to the local + /api/v1/namespaces/openshift-kube-scheduler/configmaps/kube-scheduler-pod#569895645b4f9b87d4e21ab3c6fe4cc03627259826715e5043d5d8889c6c12d3 + file. + + CIP-003-8 R4.2 + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R5.1 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SC-8 + SC-8(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 1.4.2 + In OpenShift 4, The Kubernetes Scheduler operator manages and updates the +Kubernetes Scheduler deployed on top of OpenShift. By default, the operator +exposes metrics via metrics service. The metrics are collected from the +Kubernetes Scheduler operator. Profiling data is sent to healthzPort, +the port of the localhost healthz endpoint. Changing this value may disrupt +components that monitor the kubelet health. + CCE-83674-2 + + + + + + + + + + Ensure that the port parameter is zero + The Scheduler API service which runs on port 10251/TCP by default is used for +health and metrics information and is available without authentication or +encryption. As such it should only be bound to a localhost interface, to +minimize the cluster's attack surface. + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the following: +{{.var_scheduler_filepath}} + API endpoint, filter with with the jq utility using the following filter + {{.var_scheduler_argument_filter}} + and persist it to the local + /api/v1/namespaces/openshift-kube-scheduler/configmaps/kube-scheduler-pod#569895645b4f9b87d4e21ab3c6fe4cc03627259826715e5043d5d8889c6c12d3 + file. + + 1.4.2 + In OpenShift 4, The Kubernetes Scheduler operator manages and updates the +Kubernetes Scheduler deployed on top of OpenShift. By default, the operator +exposes metrics via metrics service. The metrics are collected from the +Kubernetes Scheduler operator. Profiling data is sent to healthzPort, +the port of the localhost healthz endpoint. Changing this value may disrupt +components that monitor the kubelet health. + + + + + + + + + + + Kubernetes Secrets Management + Secrets let you store and manage sensitive information, +such as passwords, OAuth tokens, and ssh keys. +Such information might otherwise be put in a Pod +specification or in an image. + + Consider external secret storage + Consider the use of an external secrets storage and management system, +instead of using Kubernetes Secrets directly, if you have more complex +secret management needs. Ensure the solution requires authentication to +access secrets, has auditing of access to and use of secrets, and encrypts +secrets. Some solutions also make it easier to rotate secrets. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.4.2 + Kubernetes supports secrets as first-class objects, but care needs to be +taken to ensure that access to secrets is carefully limited. Using an +external secrets provider can ease the management of access to secrets, +especially where secrets are used across both Kubernetes and non-Kubernetes +environments. + + + + + + Do Not Use Environment Variables with Secrets + Secrets should be mounted as data volumes instead of environment +variables. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 5.4.1 + Environment variables are subject and very susceptible to +malicious hijacking methods by an adversary, as such, +environment variables should never be used for secrets. + + + + + + + Kubernetes - Worker Node Settings + Contains evaluations for the worker node configuration settings. + + Verify Group Who Owns The Kubelet Configuration File + To properly set the group owner of /etc/kubernetes/kubelet.conf, run the command: $ sudo chgrp root /etc/kubernetes/kubelet.conf + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.6 + The kubelet configuration file contains information about the configuration of the +OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-84233-6 + + + + + + + + + Verify Group Who Owns The Worker Proxy Kubeconfig File + To ensure the Kubernetes ConfigMap is mounted into the sdn daemonset pods with the +correct ownership, make sure that the sdn-config ConfigMap is mounted using +a ConfigMap at the /config mount point and that the sdn container +points to that configuration using the --proxy-config command line option. +Run: + oc get -nopenshift-sdn ds sdn -ojson | jq -r '.spec.template.spec.containers[] | select(.name == "sdn")' +and ensure the --proxy-config parameter points to +/config/kube-proxy-config.yaml and that the config mount point is +mounted from the sdn-config ConfigMap. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.4 + The kubeconfig file for kube-proxy provides permissions to the kube-proxy service. +The proxy kubeconfig file contains information about the administrative configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + +The file is provided via a ConfigMap mount, so the kubelet itself makes sure that the +file permissions are appropriate for the container taking it into use. + + + + + + + Verify Group Who Owns the Worker Certificate Authority File + To properly set the group owner of /etc/kubernetes/kubelet-ca.crt, run the command: $ sudo chgrp root /etc/kubernetes/kubelet-ca.crt + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.8 + The worker certificate authority file contains the certificate authority +certificate for an OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83440-8 + + + + + + + + + Verify Group Who Owns The Worker Kubeconfig File + To properly set the group owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chgrp root /var/lib/kubelet/kubeconfig + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.10 + The worker kubeconfig file contains information about the administrative configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83409-3 + + + + + + + + + Verify Group Who Owns The OpenShift Node Service File + ' + To properly set the group owner of /etc/systemd/system/kubelet.service, run the command: + $ sudo chgrp root /etc/systemd/system/kubelet.service' + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.2 + The /etc/systemd/system/kubelet.service +file contains information about the configuration of the +OpenShift node service that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83975-3 + + + + + + + + + Verify User Who Owns The Kubelet Configuration File + To properly set the owner of /var/lib/kubelet/config.json, run the command: $ sudo chown root /var/lib/kubelet/config.json + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.6 + The kubelet configuration file contains information about the configuration of the +OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-85900-9 + + + + + + + + + Verify User Who Owns The Kubelet Configuration File + To properly set the owner of /etc/kubernetes/kubelet.conf, run the command: $ sudo chown root /etc/kubernetes/kubelet.conf + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.6 + The kubelet configuration file contains information about the configuration of the +OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83976-1 + + + + + + + + + Verify User Who Owns The Worker Proxy Kubeconfig File + To ensure the Kubernetes ConfigMap is mounted into the sdn daemonset pods with the +correct ownership, make sure that the sdn-config ConfigMap is mounted using +a ConfigMap at the /config mount point and that the sdn container +points to that configuration using the --proxy-config command line option. +Run: + oc get -nopenshift-sdn ds sdn -ojson | jq -r '.spec.template.spec.containers[] | select(.name == "sdn")' +and ensure the --proxy-config parameter points to +/config/kube-proxy-config.yaml and that the config mount point is +mounted from the sdn-config ConfigMap. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.4 + The kubeconfig file for kube-proxy provides permissions to the kube-proxy service. +The proxy kubeconfig file contains information about the administrative configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + +The file is provided via a ConfigMap mount, so the kubelet itself makes sure that the +file permissions are appropriate for the container taking it into use. + + + + + + + Verify User Who Owns the Worker Certificate Authority File + To properly set the owner of /etc/kubernetes/kubelet-ca.crt, run the command: $ sudo chown root /etc/kubernetes/kubelet-ca.crt + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.8 + The worker certificate authority file contains the certificate authority +certificate for an OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83495-2 + + + + + + + + + Verify User Who Owns The Worker Kubeconfig File + To properly set the owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chown root /var/lib/kubelet/kubeconfig + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.10 + The worker kubeconfig file contains information about the administrative configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83408-5 + + + + + + + + + Verify User Who Owns The OpenShift Node Service File + ' + To properly set the owner of /etc/systemd/system/kubelet.service, run the command: + $ sudo chown root /etc/systemd/system/kubelet.service ' + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.2 + The /etc/systemd/system/kubelet.service +file contains information about the configuration of the +OpenShift node service that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-84193-2 + + + + + + + + + Verify Permissions on The Kubelet Configuration File + +To properly set the permissions of /var/lib/kubelet/config.json, run the command: +$ sudo chmod 0600 /var/lib/kubelet/config.json + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.5 + If the kubelet configuration file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the configuration of +an OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-85896-9 + + + + + + + + + Verify Permissions on The Kubelet Configuration File + +To properly set the permissions of /etc/kubernetes/kubelet.conf, run the command: +$ sudo chmod 0644 /etc/kubernetes/kubelet.conf + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.5 + If the kubelet configuration file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the configuration of +an OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83470-5 + + + + + + + + + Verify Permissions on the Worker Proxy Kubeconfig File + To ensure the Kubernetes ConfigMap is mounted into the sdn daemonset pods with the +correct permissions, make sure that the sdn-config ConfigMap is mounted using +restrictive permissions. Check that the config VolumeMount mounts the +sdn-config configMap with permissions set to 420: + +{ +"configMap": { + "defaultMode": 420, + "name": "sdn-config" + }, +"name": "config" +} + + This rule's check operates on the cluster configuration dump. +Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn API endpoint to the local /apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn file. + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + Req-2.2 + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.3 + The kube-proxy kubeconfig file controls various parameters of the kube-proxy +service in the worker node. If used, you should restrict its file permissions +to maintain the integrity of the file. The file should be writable by only +the administrators on the system. + +The kube-proxy runs with the kubeconfig parameters configured as +a Kubernetes ConfigMap instead of a file. In this case, there is no proxy +kubeconfig file. But appropriate permissions still need to be set in the +ConfigMap mount. + + CCE-84047-0 + + + + + + + + + + Verify Permissions on the Worker Certificate Authority File + +To properly set the permissions of /etc/kubernetes/kubelet-ca.crt, run the command: +$ sudo chmod 0644 /etc/kubernetes/kubelet-ca.crt + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.7 + If the worker certificate authority file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the certificate authority +certificate for an OpenShift node that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83493-7 + + + + + + + + + Verify Permissions on the Worker Kubeconfig File + +To properly set the permissions of /var/lib/kubelet/kubeconfig, run the command: +$ sudo chmod 0600 /var/lib/kubelet/kubeconfig + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.9 + If the worker kubeconfig file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the administration configuration of the +OpenShift cluster that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83509-0 + + + + + + + + + Verify Permissions on the OpenShift Node Service File + +To properly set the permissions of /etc/systemd/system/kubelet.service, run the command: +$ sudo chmod 0644 /etc/systemd/system/kubelet.service + CIP-003-8 R6 + CIP-004-6 R3 + CIP-007-3 R6.1 + CM-6 + CM-6(1) + SRG-APP-000516-CTR-001325 + SRG-APP-000516-CTR-001330 + SRG-APP-000516-CTR-001335 + 4.1.1 + If the /etc/systemd/system/kubelet.service +file is writable by a group-owner or the +world the risk of its compromise is increased. The file contains the service configuration of the +OpenShift node service that is configured on the system. Protection of this file is +critical for OpenShift security. + + CCE-83455-6 + + + + + + + + + + + + + + + combine_ovals.py from SCAP Security Guide + ssg: [0, 1, 65], python: 3.10.4 + 5.11 + 2022-10-18T20:06:08 + + + + + Ensure catch-all FlowSchema object for API Priority and Fairness Exists + + Red Hat OpenShift Container Platform 4 + + One of the flowschema versions should exist, but it doesn't matter which + + + + + + + + + + + + Configure OAuth tokens to expire after a set period of inactivity + + Red Hat OpenShift Container Platform 4 + + The inactivity timeout must be specified either per client or globally + + + + + + + + + + + Configure OAuth tokens to expire after a set period of inactivity + + Red Hat OpenShift Container Platform 4 + + The tokan max age must be specified either per client or globally + + + + + + + + + + + Configure A Unique CA Certificate for etcd + + Red Hat OpenShift Container Platform 4 + + The etcd CA should be different from the Kubernetes CA. + + + + + + + + + Ensure that a OpenShift OAuth login template or a classification banner is set + + Red Hat OpenShift Container Platform 4 + + A Legal notice must be displayed by some means. + + + + + + + + + + + Ensure workloads use resource requests and limits + + Red Hat OpenShift Container Platform 4 + + The sysctl parameter needs to be set before enabling kernel protection + + + + + + + + + + + Ensure workloads use resource requests and limits per namespace + + Red Hat OpenShift Container Platform 4 + + Ensure that application Namespaces have Network Policies defined + + + + + + + + + + + + Ensure that full disk encryption is configured on cluster nodes + + Red Hat OpenShift Container Platform 4 + + Full disk encryption should be enabled, either through the cloud provider or using FIPS + + + + + + + + + + + + + + + + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults + + Red Hat OpenShift Container Platform 4 + + The sysctl parameter needs to be set before enabling kernel protection + + + + + + + + + + + + + + + Record Access Events to Kubernetes Audit Log Directory + + Red Hat OpenShift Container Platform 4 + + Audit rules about the read events to /var/log/kube-apiserver + + + + + + + + + + + + + + + + + Record Access Events to OAuth Audit Log Directory + + Red Hat OpenShift Container Platform 4 + + Audit rules about the read events to /var/log/oauth-apiserver + + + + + + + + + + + + + + + + + Record Access Events to OpenShift Audit Log Directory + + Red Hat OpenShift Container Platform 4 + + Audit rules about the read events to /var/log/openshift-apiserver + + + + + + + + + + + + + + + + + Verify Group Who Owns The Open vSwitch Configuration Database + + Red Hat OpenShift Container Platform 4 + + One of the permission checks must pass + + + + + + + + + + + Verify Group Who Owns The Open vSwitch Configuration Database Lock + + Red Hat OpenShift Container Platform 4 + + One of the permission checks must pass + + + + + + + + + + + Verify Group Who Owns The Open vSwitch Process ID File + + Red Hat OpenShift Container Platform 4 + + This test makes sure that /run/openvswitch/ovs-vswitchd.pid is group owned by 800 or 801. + + + + + + + + + + + Verify Group Who Owns The Open vSwitch Persistent System ID + + Red Hat OpenShift Container Platform 4 + + One of the permission checks must pass + + + + + + + + + + + Verify Group Who Owns The Open vSwitch Daemon PID File + + Red Hat OpenShift Container Platform 4 + + This test makes sure that /var/run/openvswitch/ovs-vswitchd.pid is group owned by 800 or 801. + + + + + + + + + + + Verify Group Who Owns The Open vSwitch Database Server PID + + Red Hat OpenShift Container Platform 4 + + This test makes sure that /run/openvswitch/ovsdb-server.pid is group owned by 800 or 801. + + + + + + + + + + + Ensure that application Namespaces have Network Policies defined. + + Red Hat OpenShift Container Platform 4 + + Ensure that application Namespaces have Network Policies defined + + + + + + + + + + + Disable the AlwaysAdmit Admission Control Plugin + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^AlwaysAdmit$' + + + + + + + + + + + Ensure that the Admission Control Plugin AlwaysPullImages is not set + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^AlwaysPullImages$' + + + + + + + + + + Enable the NamespaceLifecycle Admission Control Plugin + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^NamespaceLifecycle$' + + + + + + + + + + + Enable the NodeRestriction Admission Control Plugin + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^NodeRestriction$' + + + + + + + + + + + Enable the SecurityContextConstraint Admission Control Plugin + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^security.openshift.io/SecurityContextConstraint$' + + + + + + + + + + + Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^SecurityContextDeny$' + + + + + + + + + + + Enable the ServiceAccount Admission Control Plugin + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^ServiceAccount$' + + + + + + + + + + + Ensure that anonymous requests to the API Server are authorized + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/rbac.authorization.k8s.io/v1/clusterrolebindings' at path '.items[:]['subjects'][:].name' at least one: value equals 'system:unauthenticated' + + + + + + + + + + Enable the APIPriorityAndFairness feature gate + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/operator.openshift.io/v1/kubeapiservers/cluster' at path '.spec.observedConfig.apiServerArguments["feature-gates"][:]' all: value equals '^APIPriorityAndFairness=true$' + + + + + + + + + + + Ensure catch-all FlowSchema object for API Priority and Fairness Exists (v1alpha1) + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/flowcontrol.apiserver.k8s.io/v1alpha1/flowschemas/catch-all' at path '.spec.rules[0].subjects[:].group["name"]' at least one: value equals 'system:authenticated' + + + + + + + + + + + Ensure catch-all FlowSchema object for API Priority and Fairness Exists + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/catch-all' at path '.spec.rules[0].subjects[:].group["name"]' at least one: value equals 'system:authenticated' + + + + + + + + + + + Ensure catch-all FlowSchema object for API Priority and Fairness Exists + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/catch-all' at path '.spec.rules[0].subjects[:].group["name"]' at least one: value equals 'system:authenticated' + + + + + + + + + + + Configure the Kubernetes API Server Maximum Retained Audit Logs + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-maxbackup"][:]' at least one: value equals '10' + + + + + + + + + + + Configure Kubernetes API Server Maximum Audit Log Size + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-maxsize"][:]' at least one: value equals '100' + + + + + + + + + + + Configure the Audit Log Path + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-path"][:]' at least one: value equals '.+' + + + + + + + + + + + The authorization-mode cannot be AlwaysAllow + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["authorization-mode"][:]' all: value equals 'AlwaysAllow' + + + + + + + + + + + Ensure authorization-mode Node is configured + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["authorization-mode"][:]' at least one: value equals 'Node' + + + + + + + + + + + Ensure authorization-mode RBAC is configured + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["authorization-mode"][:]' at least one: value equals 'RBAC' + + + + + + + + + + + Disable basic-auth-file for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments[:]' all: key 'basic-auth-file' value equals '' + + + + + + + + + + + Ensure that the bindAddress is set to a relevant secure port + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.servingInfo["bindAddress"]' all: value equals '(.+)' + + + + + + + + + + + Configure the Client Certificate Authority for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["client-ca-file"]' all: value equals '(.+)' + + + + + + + + + + + Configure the Encryption Provider Cipher + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/config.openshift.io/v1/apiservers/cluster' at path '.spec.encryption.type' at least one: value equals 'aescbc' + + + + + + + + + + Configure the Encryption Provider + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/config.openshift.io/v1/apiservers/cluster' at path '.spec.encryption.type' at least one: value equals 'aescbc' + + + + + + + + + + + Configure the etcd Certificate Authority for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-cafile"][:]' all: value equals '(.+)' + + + + + + + + + + + Configure the etcd Certificate for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-certfile"][:]' all: value equals '.*\.crt' + + + + + + + + + + + Configure the etcd Certificate Key for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-keyfile"][:]' all: value equals '.*\.key' + + + + + + + + + + + Ensure that the --kubelet-https argument is set to true + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments[:]' all: key 'kubelet-https' value equals '' + + + + + + + + + + Disable Use of the Insecure Bind Address + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#95b5b27bb6ea2b122e810c99c17c2430c4845596942804847dd677557cfed88e' at path '.apiServerArguments[:]' all: value equals 'insecure-bind-address' + + + + + + + + + + + Prevent Insecure Port Access + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["insecure-port"][:]' all: value equals '0' + + + + + + + + + + + Configure the kubelet Certificate Authority for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-certificate-authority"][:]' all: value equals '(.+)' + + + + + + + + + + + Configure the kubelet Certificate File for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-certificate"][:]' all: value equals '(.+)' + + + + + + + + + + + Configure the kubelet Certificate File for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data["config.yaml"]' all: value equals '"kubelet-client-certificate":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt"\]' + + + + + + + + + + + Configure the kubelet Certificate Key for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-key"][:]' all: value equals '(.+)' + + + + + + + + + + + Configure the kubelet Certificate Key for the API Server + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data["config.yaml"]' all: value equals '"kubelet-client-key":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.key"\]' + + + + + + + + + + + Ensure all admission control plugins are enabled + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#8c02c853df9307960712da853d79f916a091fe8bce6312720d7c17de03c2017b' at path '[:]' all: value equals '(.*?)' + + + + + + + + + + + Profiling is protected by RBAC + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger' at path '.rules[0].nonResourceURLs[:]' at least one: value equals '\/metrics' + + + + + + + + + + + Configure the API Server Minimum Request Timeout + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["min-request-timeout"][:]' at least one: value equals '(\d*)' + + + + + + + + - Ensure catch-all FlowSchema object for API Priority and Fairness Exists + Ensure that the service-account-lookup argument is set to true Red Hat OpenShift Container Platform 4 - One of the flowschema versions should exist, but it doesn't matter which - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["service-account-lookup"][:]' at least one: value equals 'true' + + - - - - + + + - + - Configure OAuth tokens to expire after a set period of inactivity + Configure the Service Account Public Key for the API Server Red Hat OpenShift Container Platform 4 - The inactivity timeout must be specified either per client or globally - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.serviceAccountPublicKeyFiles[:]' at least one: value equals '.+' + + - - - + + + - + - Configure OAuth tokens to expire after a set period of inactivity + Configure the Certificate for the API Server Red Hat OpenShift Container Platform 4 - The tokan max age must be specified either per client or globally - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["tls-cert-file"][:]' all: value equals '(.+)' + + - - - + + + - + - Configure A Unique CA Certificate for etcd + Use Strong Cryptographic Ciphers on the API Server Red Hat OpenShift Container Platform 4 - The etcd CA should be different from the Kubernetes CA. - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.servingInfo.cipherSuites[:]' all: value equals 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' + - + + - + - Ensure that a OpenShift OAuth login template or a classification banner is set + Configure the Certificate Key for the API Server Red Hat OpenShift Container Platform 4 - A Legal notice must be displayed by some means. - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["tls-private-key-file"][:]' all: value equals '(.+)' + + - - - + + + - + - Ensure workloads use resource requests and limits + Disable Token-based Authentication Red Hat OpenShift Container Platform 4 - The sysctl parameter needs to be set before enabling kernel protection - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^token-auth-file$' + + - - - + + + - + - Ensure workloads use resource requests and limits per namespace + Ensure that Audit Log Errors Emit Alerts Red Hat OpenShift Container Platform 4 - Ensure that application Namespaces have Network Policies defined - - + In the YAML/JSON file '/apis/monitoring.coreos.com/v1/prometheusrules?limit=500#72e9ad360bb6bdf4ad9e43217cd0ec9cb90e7c3b08d4fbe0edf087ad899e05a6' at path '[:]' all: value equals '^.*apiserver_audit_error_total.*apiserver_audit_event_total.*$' + + - - - + + - + - Ensure that full disk encryption is configured on cluster nodes + Ensure that Audit Log Forwarding Is Enabled Red Hat OpenShift Container Platform 4 - Full disk encryption should be enabled, either through the cloud provider or using FIPS - - + In the YAML/JSON file '/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance' at path 'spec.pipelines[:].inputRefs[:]' at least one: value equals 'audit' + + - - - - - - - - + + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults + Ensure that Audit Log Forwarding Uses TLS Red Hat OpenShift Container Platform 4 - The sysctl parameter needs to be set before enabling kernel protection - + In the YAML/JSON file '/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance#71786452ba18c51ba8ad51472a078619e2e8b52a86cd75087af5aab42400f6c0' at path '[:]' all: value equals '^(https|tls)://.*$' + + - - - - - - - - + + + - + - Record Access Events to Kubernetes Audit Log Directory + Ensure that the cluster's audit profile is properly set Red Hat OpenShift Container Platform 4 - Audit rules about the read events to /var/log/kube-apiserver - - + In the YAML/JSON file '/apis/config.openshift.io/v1/apiservers/cluster' at path 'spec.audit.profile' all: + + - - - - - - - - - + + + - + - Record Access Events to OAuth Audit Log Directory + Ensure that the MachineSets provisioned by Azure have disk encryption enabled Red Hat OpenShift Container Platform 4 - Audit rules about the read events to /var/log/oauth-apiserver - - + In the YAML/JSON file '/apis/machine.openshift.io/v1beta1/machinesets?limit=500#b9dfb8d8585cff7f72cd7403be3b5790ff7716fbe23facf6e251712ade7d60c1' at path '[:]' all: value equals '^.+$' + + - - - - - - - - - + + + - + - Record Access Events to OpenShift Audit Log Directory + Enable Classification Banner on OpenShift Console Red Hat OpenShift Container Platform 4 - Audit rules about the read events to /var/log/openshift-apiserver - - + In the YAML/JSON file '/apis/console.openshift.io/v1/consolenotifications/classification-banner' at path '.spec.text' at least one: value equals '.*' + + - - - - - - - - - + + + - + - Verify Group Who Owns The Open vSwitch Configuration Database + Ensure that OpenShift Logging Operator is scanning the cluster Red Hat OpenShift Container Platform 4 - One of the permission checks must pass - - + In the YAML/JSON file '/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterloggings/instance' at path 'metadata.name' at least one: value equals '.*' + + - - - + + + - + - Verify Group Who Owns The Open vSwitch Configuration Database Lock + Ensure that Cluster Version Operator is deployed Red Hat OpenShift Container Platform 4 - One of the permission checks must pass - - + In the YAML/JSON file '/apis/config.openshift.io/v1/clusterversions/version#588c29ac9d4c67b1444308c5ba310271832895fee54701f7d0cb6cbced390443' at path '[:]' all: value equals 'True' + + - - - + + + - + - Verify Group Who Owns The Open vSwitch Process ID File + Ensure that Cluster Version Operator verifies integrity Red Hat OpenShift Container Platform 4 - This test makes sure that /run/openvswitch/ovs-vswitchd.pid is group owned by 800 or 801. - - + In the YAML/JSON file '/apis/config.openshift.io/v1/clusterversions/version#69adcfd65c8b8d723e4a7118c170f634cebbb349e9b554dd15001e6551a586f8' at path '[:]' all: value equals 'true' + + - - - + + + - + - Verify Group Who Owns The Open vSwitch Persistent System ID + Ensure that cluster-wide proxy is set Red Hat OpenShift Container Platform 4 - One of the permission checks must pass - - + In the YAML/JSON file '/apis/config.openshift.io/v1/proxies/cluster' at path '.spec.httpsProxy' all: value equals '.+' + + - - - + + + + - + - Verify Group Who Owns The Open vSwitch Daemon PID File + Ensure the notification is enabled for Compliance Operator Red Hat OpenShift Container Platform 4 - This test makes sure that /var/run/openvswitch/ovs-vswitchd.pid is group owned by 800 or 801. - - + In the YAML/JSON file '/apis/monitoring.coreos.com/v1/prometheusrules?limit=500#235ac8b4e63854fbdc11eefc4f8fcf6a20f55f7991b08618e698f2ead111925a' at path '[:]' at least one: value equals '.*' + + - - - + + + - + - Verify Group Who Owns The Open vSwitch Database Server PID + Ensure that Compliance Operator is scanning the cluster Red Hat OpenShift Container Platform 4 - This test makes sure that /run/openvswitch/ovsdb-server.pid is group owned by 800 or 801. - - + In the YAML/JSON file '/apis/compliance.openshift.io/v1alpha1/compliancesuites?limit=5' at path '.items[:].metadata.name' at least one: value equals '.*' + + - - - + + + - + - Ensure that application Namespaces have Network Policies defined. + Ensure that the CNI in use supports Network Policies Red Hat OpenShift Container Platform 4 - Ensure that application Namespaces have Network Policies defined - + In the YAML/JSON file '/apis/operator.openshift.io/v1/networks/cluster#35e33d6dc1252a03495b35bd1751cac70041a511fa4d282c300a8b83b83e3498' at path '[:]' all: value equals 'OpenShiftSDN|OVN|Calico' + - - - + + - + - Disable the AlwaysAdmit Admission Control Plugin + Ensure Controller insecure port argument is unset Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^AlwaysAdmit$' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#9f09cca56dc1e9f9605eb5a94aed74de554fd209513a9222e4fe9c0ed669aeee' at path '[:]' all: value equals 'true' + + - - + + - + - Ensure that the Admission Control Plugin AlwaysPullImages is not set + Ensure that the RotateKubeletServerCertificate argument is set Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^AlwaysPullImages$' - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#4cbbbf49b93400715e43dc698f6484799805c502ad3aeb8285de579753b54d31' at path '[:]' at least one: value equals 'RotateKubeletServerCertificate=true' + + - - + + - + - Enable the NamespaceLifecycle Admission Control Plugin + Ensure Controller secure-port argument is set Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^NamespaceLifecycle$' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#8241ce1009dc5dd166436d0311b60b96aa3a2f591ba43a26e2b9d0bfc9071414' at path '[:]' at least one: value equals 'true' + + - - + + - + - Enable the NodeRestriction Admission Control Plugin + Configure the Service Account Certificate Authority Key for the Controller Manager Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^NodeRestriction$' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#e27218fb5fb7cd68a9911eb2db6bf715ca959f639e56cb60f90be782ddd7fcf8' at path '[:]' at least one: value equals 'true' + + - - + + - + - Enable the SecurityContextConstraint Admission Control Plugin + Configure the Service Account Private Key for the Controller Manager Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^security.openshift.io/SecurityContextConstraint$' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#407a17f0f401ae8c92955bc382bc80ee34a9afd51ab787e405bf524d03ebf3c8' at path '[:]' at least one: value equals 'true' + + - - + + - + - Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used + Ensure that use-service-account-credentials is enabled Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^SecurityContextDeny$' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#be4ff4c2d3e706eb3b2f17921e5163bca81082bd313ff067ef625af9e6cb61ff' at path '[:]' at least one: value equals 'true' + + - - + + - + - Enable the ServiceAccount Admission Control Plugin + Ensure that the default Ingress CA (wildcard issuer) has been replaced Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^ServiceAccount$' - - + In the YAML/JSON file '/apis/config.openshift.io/v1/proxies/cluster' at path '.spec.trustedCA.name' all: value equals '.+' + - - + + + - + - Ensure that anonymous requests to the API Server are authorized + The Kubernetes Audit Logs Directory Must Have Mode 0700 Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/rbac.authorization.k8s.io/v1/clusterrolebindings' at path '.items[:]['subjects'][:].name' at least one: value equals 'system:unauthenticated' - + This test makes sure that /var/log/kube-apiserver/ has mode 0700. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + + + + + + + + + The OAuth Audit Logs Directory Must Have Mode 0700 + + Red Hat OpenShift Container Platform 4 + + This test makes sure that /var/log/oauth-apiserver/ has mode 0700. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + + + + + + + + + The OpenShift Audit Logs Directory Must Have Mode 0700 + + Red Hat OpenShift Container Platform 4 + + This test makes sure that /var/log/openshift-apiserver/ has mode 0700. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + + + + + + + + + Ensure that EBS volumes use by cluster nodes are encrypted + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/apis/machine.openshift.io/v1beta1/machinesets?limit=500#06ea2adfb5429a7351e7bd78b7ec378225e0d3256c4c9e4e3b2ce59900959267' at path '[:]' all: value equals 'true' + + + + + + + + + + + Disable etcd Self-Signed Certificates + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' none satisfy: value equals '.*auto-tls[= ]true.*' + + + + + + + + + + + Ensure That The etcd Client Certificate Is Correctly Set + + Red Hat OpenShift Container Platform 4 + + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--cert-file=' + + - - + + - + - Enable the APIPriorityAndFairness feature gate + Ensure ETCD has correct cipher suite Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/operator.openshift.io/v1/kubeapiservers/cluster' at path '.spec.observedConfig.apiServerArguments["feature-gates"][:]' all: value equals '^APIPriorityAndFairness=true$' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod' at path '.data['pod.yaml']' all: value equals 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256' + + - - + + - + - Ensure catch-all FlowSchema object for API Priority and Fairness Exists (v1alpha1) + Enable The Client Certificate Authentication Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/flowcontrol.apiserver.k8s.io/v1alpha1/flowschemas/catch-all' at path '.spec.rules[0].subjects[:].group["name"]' at least one: value equals 'system:authenticated' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '.*--client-cert-auth=true \.*' + + - - + + - + - Ensure catch-all FlowSchema object for API Priority and Fairness Exists + Ensure That The etcd Key File Is Correctly Set Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/catch-all' at path '.spec.rules[0].subjects[:].group["name"]' at least one: value equals 'system:authenticated' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--key-file=' + + - - + + - + - Ensure catch-all FlowSchema object for API Priority and Fairness Exists + Disable etcd Peer Self-Signed Certificates Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/catch-all' at path '.spec.rules[0].subjects[:].group["name"]' at least one: value equals 'system:authenticated' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' none satisfy: value equals '.*peer-auto-tls[= ]true.*' + + - - + + - + - Configure the Kubernetes API Server Maximum Retained Audit Logs + Ensure That The etcd Peer Client Certificate Is Correctly Set Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-maxbackup"][:]' at least one: value equals '10' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--peer-cert-file=' + + - - + + - + - Configure Kubernetes API Server Maximum Audit Log Size + Enable The Peer Client Certificate Authentication Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-maxsize"][:]' at least one: value equals '100' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--peer-client-cert-auth=true' + + - - + + - + - Configure the Audit Log Path + Ensure That The etcd Peer Key File Is Correctly Set Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-path"][:]' at least one: value equals '.+' - - + In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--peer-key-file=' + + - - + + - + - The authorization-mode cannot be AlwaysAllow + Verify Group Who Owns The OpenShift Container Network Interface Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["authorization-mode"][:]' all: value equals 'AlwaysAllow' - - + This test makes sure that ^/etc/cni/net.d/.*$ is group owned by 0. + + - - + - + - Ensure authorization-mode Node is configured + Verify Group Who Owns The OpenShift Controller Manager Kubeconfig File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["authorization-mode"][:]' at least one: value equals 'Node' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/configmaps/controller-manager-kubeconfig/kubeconfig$ is group owned by 0. + + - - + - + - Ensure authorization-mode RBAC is configured + Verify Group Who Owns The Etcd Database Directory Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["authorization-mode"][:]' at least one: value equals 'RBAC' - - + This test makes sure that /var/lib/etcd/member/ is group owned by 0. + + - - + - + - Disable basic-auth-file for the API Server + Verify Group Who Owns The Etcd Write-Ahead-Log Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments[:]' all: key 'basic-auth-file' value equals '' - - + This test makes sure that ^/var/lib/etcd/member/wal/.*$ is group owned by 0. + + - - + - + - Ensure that the bindAddress is set to a relevant secure port + Verify Group Who Owns The etcd Member Pod Specification File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.servingInfo["bindAddress"]' all: value equals '(.+)' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-pod-.*/etcd-pod.yaml$ is group owned by 0. + + - - + - + - Configure the Client Certificate Authority for the API Server + Verify Group Who Owns The Etcd PKI Certificate Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["client-ca-file"]' all: value equals '(.+)' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.crt$ is group owned by 0. + + - - + - + - Configure the Encryption Provider Cipher + Verify Group Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/config.openshift.io/v1/apiservers/cluster' at path '.spec.encryption.type' at least one: value equals 'aescbc' - + This test makes sure that ^/var/lib/cni/networks/openshift-sdn/.*$ is group owned by 0. + + - - + - + - Configure the Encryption Provider + Verify Group Who Owns The Kubernetes API Server Pod Specification File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/config.openshift.io/v1/apiservers/cluster' at path '.spec.encryption.type' at least one: value equals 'aescbc' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-pod-.*/kube-apiserver-pod.yaml$ is group owned by 0. + + - - + - + - Configure the etcd Certificate Authority for the API Server + Verify Group Who Owns The Kubernetes Controller Manager Pod Specification File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-cafile"][:]' all: value equals '(.+)' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$ is group owned by 0. + + - - + - + - Configure the etcd Certificate for the API Server + Verify Group Who Owns The Kubernetes Scheduler Pod Specification File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-certfile"][:]' all: value equals '.*\.crt' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$ is group owned by 0. + + - - + - + - Configure the etcd Certificate Key for the API Server + Verify Group Who Owns The Kubelet Configuration File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-keyfile"][:]' all: value equals '.*\.key' - - + This test makes sure that /etc/kubernetes/kubelet.conf is group owned by 0. + + - - + - + - Ensure that the --kubelet-https argument is set to true + Verify Group Who Owns The OpenShift Admin Kubeconfig Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments[:]' all: key 'kubelet-https' value equals '' - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$ is group owned by 0. + + - - + - + - Disable Use of the Insecure Bind Address + Verify Group Who Owns The OpenShift Multus Container Network Interface Plugin Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#95b5b27bb6ea2b122e810c99c17c2430c4845596942804847dd677557cfed88e' at path '.apiServerArguments[:]' all: value equals 'insecure-bind-address' - - + This test makes sure that ^/var/run/multus/cni/net.d/.*$ is group owned by 0. + + - - + - + - Prevent Insecure Port Access + Verify Group Who Owns The OpenShift PKI Certificate Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["insecure-port"][:]' all: value equals '0' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/tls\.crt$ is group owned by 0. + + - - + - + - Configure the kubelet Certificate Authority for the API Server + Verify Group Who Owns The OpenShift PKI Private Key Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-certificate-authority"][:]' all: value equals '(.+)' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$ is group owned by 0. + + - - + - + - Configure the kubelet Certificate File for the API Server + Verify Group Who Owns The OpenShift SDN CNI Server Config Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-certificate"][:]' all: value equals '(.+)' - - + This test makes sure that /var/run/openshift-sdn/cniserver/config.json is group owned by 0. + + - - + - + - Configure the kubelet Certificate File for the API Server + Verify Group Who Owns The OpenShift Open vSwitch Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data["config.yaml"]' all: value equals '"kubelet-client-certificate":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt"\]' - - + This test makes sure that /etc/openvswitch/ is group owned by 0. + - - + - + - Configure the kubelet Certificate Key for the API Server + Verify Group Who Owns The Open vSwitch Configuration Database Lock Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-key"][:]' all: value equals '(.+)' - - + This test makes sure that /etc/openvswitch/.conf.db.~lock~ is group owned by 801. + + - - + - + - Configure the kubelet Certificate Key for the API Server + Verify Group Who Owns The Open vSwitch Configuration Database Lock Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data["config.yaml"]' all: value equals '"kubelet-client-key":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.key"\]' - - + This test makes sure that /etc/openvswitch/.conf.db.~lock~ is group owned by 800. + + - - + - + - Ensure all admission control plugins are enabled + Verify Group Who Owns The Open vSwitch Configuration Database Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#8c02c853df9307960712da853d79f916a091fe8bce6312720d7c17de03c2017b' at path '[:]' all: value equals '(.*?)' - - + This test makes sure that /etc/openvswitch/conf.db is group owned by 801. + + - - + - + - Profiling is protected by RBAC + Verify Group Who Owns The Open vSwitch Configuration Database Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger' at path '.rules[0].nonResourceURLs[:]' at least one: value equals '\/metrics' - - + This test makes sure that /etc/openvswitch/conf.db is group owned by 800. + + - - + - + - Configure the API Server Minimum Request Timeout + Verify Group Who Owns The Open vSwitch Persistent System ID Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["min-request-timeout"][:]' at least one: value equals '(\d*)' - + This test makes sure that /etc/openvswitch/system-id.conf is group owned by 801. + + - - + - + - Ensure that the service-account-lookup argument is set to true + Verify Group Who Owns The Open vSwitch Persistent System ID Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["service-account-lookup"][:]' at least one: value equals 'true' - - + This test makes sure that /etc/openvswitch/system-id.conf is group owned by 800. + + - - + - + - Configure the Service Account Public Key for the API Server + Verify Group Who Owns The Kubernetes Scheduler Kubeconfig File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.serviceAccountPublicKeyFiles[:]' at least one: value equals '.+' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$ is group owned by 0. + + - - + - + - Configure the Certificate for the API Server + Verify Group Who Owns the Worker Certificate Authority File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["tls-cert-file"][:]' all: value equals '(.+)' - - + This test makes sure that /etc/kubernetes/kubelet-ca.crt is group owned by 0. + + - - + - + - Use Strong Cryptographic Ciphers on the API Server + Verify Group Who Owns The Worker Kubeconfig File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.servingInfo.cipherSuites[:]' all: value equals 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' - + This test makes sure that /var/lib/kubelet/kubeconfig is group owned by 0. + + - - + - + - Configure the Certificate Key for the API Server + Verify Group Who Owns The OpenShift Node Service File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["tls-private-key-file"][:]' all: value equals '(.+)' - - + This test makes sure that /etc/systemd/system/kubelet.service is group owned by 0. + + - - + - + - Disable Token-based Authentication + Ensure that File Integrity Operator is scanning the cluster Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^token-auth-file$' - - + In the YAML/JSON file '/apis/fileintegrity.openshift.io/v1alpha1/fileintegrities?limit=5' at path '.items[:].metadata.name' at least one: value equals '.*' + + - - + + - + - Ensure that Audit Log Errors Emit Alerts + Ensure the notification is enabled for file integrity operator Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/monitoring.coreos.com/v1/prometheusrules?limit=500#72e9ad360bb6bdf4ad9e43217cd0ec9cb90e7c3b08d4fbe0edf087ad899e05a6' at path '[:]' all: value equals '^.*apiserver_audit_error_total.*apiserver_audit_event_total.*$' - - + In the YAML/JSON file '/apis/monitoring.coreos.com/v1/prometheusrules?limit=500#1af9e378f0bc0282076028afdb43f9d17f4cfb2f631c4d73ce65d9d0f3b10a08' at path '[:]' at least one: value equals '.*' + + - - + + - + - Ensure that Audit Log Forwarding Is Enabled + Verify User Who Owns The OpenShift Container Network Interface Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance' at path 'spec.pipelines[:].inputRefs[:]' at least one: value equals 'audit' - - + This test makes sure that ^/etc/cni/net.d/.*$ is owned by 0. + + - - + - + - Ensure that Audit Log Forwarding Uses TLS + Verify User Who Owns The OpenShift Controller Manager Kubeconfig File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterlogforwarders/instance#71786452ba18c51ba8ad51472a078619e2e8b52a86cd75087af5aab42400f6c0' at path '[:]' all: value equals '^(https|tls)://.*$' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/configmaps/controller-manager-kubeconfig/kubeconfig$ is owned by 0. + + - - + - + - Ensure that the cluster's audit profile is properly set + Verify User Who Owns The Etcd Database Directory - Red Hat OpenShift Container Platform 4 - - In the YAML/JSON file '/apis/config.openshift.io/v1/apiservers/cluster' at path 'spec.audit.profile' all: - - + Red Hat OpenShift Container Platform 4 + + This test makes sure that /var/lib/etcd/member/ is owned by 0. + + - - + - + - Ensure that the MachineSets provisioned by Azure have disk encryption enabled + Verify User Who Owns The Etcd Write-Ahead-Log Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/machine.openshift.io/v1beta1/machinesets?limit=500#b9dfb8d8585cff7f72cd7403be3b5790ff7716fbe23facf6e251712ade7d60c1' at path '[:]' all: value equals '^.+$' - - + This test makes sure that ^/var/lib/etcd/member/wal/.*$ is owned by 0. + + - - + - + - Enable Classification Banner on OpenShift Console + Verify User Who Owns The Etcd Member Pod Specification File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/console.openshift.io/v1/consolenotifications/classification-banner' at path '.spec.text' at least one: value equals '.*' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-pod-.*/etcd-pod.yaml$ is owned by 0. + + - - + - + - Ensure that OpenShift Logging Operator is scanning the cluster + Verify User Who Owns The Etcd PKI Certificate Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/logging.openshift.io/v1/namespaces/openshift-logging/clusterloggings/instance' at path 'metadata.name' at least one: value equals '.*' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.crt$ is owned by 0. + + - - + - + - Ensure that Cluster Version Operator is deployed + Verify User Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/config.openshift.io/v1/clusterversions/version#588c29ac9d4c67b1444308c5ba310271832895fee54701f7d0cb6cbced390443' at path '[:]' all: value equals 'True' - - + This test makes sure that ^/var/lib/cni/networks/openshift-sdn/.*$ is owned by 0. + + - - + - + - Ensure that Cluster Version Operator verifies integrity + Verify User Who Owns The Kubernetes API Server Pod Specification File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/config.openshift.io/v1/clusterversions/version#69adcfd65c8b8d723e4a7118c170f634cebbb349e9b554dd15001e6551a586f8' at path '[:]' all: value equals 'true' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-pod-.*/kube-apiserver-pod.yaml$ is owned by 0. + + - - + - + - Ensure that cluster-wide proxy is set + Verify User Who Owns The Kubernetes Controller Manager Pod Specificiation File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/config.openshift.io/v1/proxies/cluster' at path '.spec.httpsProxy' all: value equals '.+' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$ is owned by 0. + + - - - + - + - Ensure the notification is enabled for Compliance Operator + Verify User Who Owns The Kubernetes Scheduler Pod Specification File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/monitoring.coreos.com/v1/prometheusrules?limit=500#235ac8b4e63854fbdc11eefc4f8fcf6a20f55f7991b08618e698f2ead111925a' at path '[:]' at least one: value equals '.*' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$ is owned by 0. + + - - + - + - Ensure that Compliance Operator is scanning the cluster + Verify User Who Owns The Kubelet Configuration File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/compliance.openshift.io/v1alpha1/compliancesuites?limit=5' at path '.items[:].metadata.name' at least one: value equals '.*' - - + This test makes sure that /var/lib/kubelet/config.json is owned by 0. + + - - + - + - Ensure that the CNI in use supports Network Policies + Verify User Who Owns The Kubelet Configuration File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/operator.openshift.io/v1/networks/cluster#35e33d6dc1252a03495b35bd1751cac70041a511fa4d282c300a8b83b83e3498' at path '[:]' all: value equals 'OpenShiftSDN|OVN|Calico' - + This test makes sure that /etc/kubernetes/kubelet.conf is owned by 0. + + - - + - + - Ensure Controller insecure port argument is unset + Verify User Who Owns The OpenShift Admin Kubeconfig Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#9f09cca56dc1e9f9605eb5a94aed74de554fd209513a9222e4fe9c0ed669aeee' at path '[:]' all: value equals 'true' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$ is owned by 0. + + - - + - + - Ensure that the RotateKubeletServerCertificate argument is set + Verify User Who Owns The OpenShift Multus Container Network Interface Plugin Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#4cbbbf49b93400715e43dc698f6484799805c502ad3aeb8285de579753b54d31' at path '[:]' at least one: value equals 'RotateKubeletServerCertificate=true' - - + This test makes sure that ^/var/run/multus/cni/net.d/.*$ is owned by 0. + + - - + - + - Ensure Controller secure-port argument is set + Verify User Who Owns The OpenShift PKI Certificate Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#8241ce1009dc5dd166436d0311b60b96aa3a2f591ba43a26e2b9d0bfc9071414' at path '[:]' at least one: value equals 'true' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/tls\.crt$ is owned by 0. + + - - + - + - Configure the Service Account Certificate Authority Key for the Controller Manager + Verify User Who Owns The OpenShift PKI Private Key Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#e27218fb5fb7cd68a9911eb2db6bf715ca959f639e56cb60f90be782ddd7fcf8' at path '[:]' at least one: value equals 'true' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$ is owned by 0. + + - - + - + - Configure the Service Account Private Key for the Controller Manager + Verify User Who Owns The OpenShift SDN CNI Server Config Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#407a17f0f401ae8c92955bc382bc80ee34a9afd51ab787e405bf524d03ebf3c8' at path '[:]' at least one: value equals 'true' - - + This test makes sure that /var/run/openshift-sdn/cniserver/config.json is owned by 0. + + - - + - + - Ensure that use-service-account-credentials is enabled + Verify User Who Owns The OpenShift Open vSwitch Files Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-controller-manager/configmaps/config#be4ff4c2d3e706eb3b2f17921e5163bca81082bd313ff067ef625af9e6cb61ff' at path '[:]' at least one: value equals 'true' - - + This test makes sure that /etc/openvswitch/ is owned by 0. + - - + - + - Ensure that the default Ingress CA (wildcard issuer) has been replaced + Verify User Who Owns The Open vSwitch Configuration Database Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/config.openshift.io/v1/proxies/cluster' at path '.spec.trustedCA.name' all: value equals '.+' - + This test makes sure that /etc/openvswitch/conf.db is owned by 800. + + - - - + - + - The Kubernetes Audit Logs Directory Must Have Mode 0700 + Verify User Who Owns The Open vSwitch Configuration Database Lock Red Hat OpenShift Container Platform 4 - This test makes sure that /var/log/kube-apiserver/ has mode 0700. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + This test makes sure that /etc/openvswitch/.conf.db.~lock~ is owned by 800. + + - + - + - The OAuth Audit Logs Directory Must Have Mode 0700 + Verify User Who Owns The Open vSwitch Process ID File Red Hat OpenShift Container Platform 4 - This test makes sure that /var/log/oauth-apiserver/ has mode 0700. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + This test makes sure that /var/run/openvswitch/ovs-vswitchd.pid is owned by 800. + + - + - + - The OpenShift Audit Logs Directory Must Have Mode 0700 + Verify User Who Owns The Open vSwitch Persistent System ID Red Hat OpenShift Container Platform 4 - This test makes sure that /var/log/openshift-apiserver/ has mode 0700. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + This test makes sure that /etc/openvswitch/system-id.conf is owned by 800. + + - + - + - Ensure that EBS volumes use by cluster nodes are encrypted + Verify User Who Owns The Open vSwitch Daemon PID File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/machine.openshift.io/v1beta1/machinesets?limit=500#06ea2adfb5429a7351e7bd78b7ec378225e0d3256c4c9e4e3b2ce59900959267' at path '[:]' all: value equals 'true' - - + This test makes sure that /run/openvswitch/ovs-vswitchd.pid is owned by 800. + + - - + - + - Disable etcd Self-Signed Certificates + Verify User Who Owns The Open vSwitch Database Server PID Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' none satisfy: value equals '.*auto-tls[= ]true.*' - - + This test makes sure that /run/openvswitch/ovsdb-server.pid is owned by 800. + + - - + - + - Ensure That The etcd Client Certificate Is Correctly Set + Verify User Who Owns The Kubernetes Scheduler Kubeconfig File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--cert-file=' - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$ is owned by 0. + + - - + - + - Ensure ETCD has correct cipher suite + Verify User Who Owns The OpenShift etcd Data Directory Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod' at path '.data['pod.yaml']' all: value equals 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256' - - + This test makes sure that /var/lib/etcd/ is owned by 0. + - - + - + - Enable The Client Certificate Authentication + Verify User Who Owns the Worker Certificate Authority File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '.*--client-cert-auth=true \.*' - - + This test makes sure that /etc/kubernetes/kubelet-ca.crt is owned by 0. + + - - + - + - Ensure That The etcd Key File Is Correctly Set + Verify User Who Owns The Worker Kubeconfig File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--key-file=' - - + This test makes sure that /var/lib/kubelet/kubeconfig is owned by 0. + + - - + - + - Disable etcd Peer Self-Signed Certificates + Verify User Who Owns The OpenShift Node Service File Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' none satisfy: value equals '.*peer-auto-tls[= ]true.*' - - + This test makes sure that /etc/systemd/system/kubelet.service is owned by 0. + + - - + - + - Ensure That The etcd Peer Client Certificate Is Correctly Set + Kubernetes Audit Logs Must Be Owned By Root Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--peer-cert-file=' - - + This test makes sure that ^/var/log/kube-apiserver($|/.*$) is owned by 0. + + - - + - + - Enable The Peer Client Certificate Authentication + OAuth Audit Logs Must Be Owned By Root Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--peer-client-cert-auth=true' - - + This test makes sure that ^/var/log/oauth-apiserver($|/.*$) is owned by 0. + + - - + - + - Ensure That The etcd Peer Key File Is Correctly Set + OpenShift Audit Logs Must Be Owned By Root Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod#72b7530e9fb0f39686f598b00d791485841e98be902ba16431a5629726dd7027' at path '[:]' all: value equals '--peer-key-file=' - - + This test makes sure that ^/var/log/openshift-apiserver($|/.*$) is owned by 0. + + - - + - + - Verify Group Who Owns The OpenShift Container Network Interface Files + Verify Permissions on the OpenShift Container Network Interface Files Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/cni/net.d/.*$ is group owned by 0. - - + This test makes sure that ^/etc/cni/net.d/.*$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The OpenShift Controller Manager Kubeconfig File + Verify Permissions on the OpenShift Controller Manager Kubeconfig File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/configmaps/controller-manager-kubeconfig/kubeconfig$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/configmaps/controller-manager-kubeconfig/kubeconfig$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Etcd Database Directory + Verify Permissions on the Etcd Database Directory Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/etcd/member/ is group owned by 0. - - + This test makes sure that /var/lib/etcd/member/ has mode 0700. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Etcd Write-Ahead-Log Files + Verify Permissions on the Etcd Write-Ahead-Log Files Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/lib/etcd/member/wal/.*$ is group owned by 0. - - + This test makes sure that ^/var/lib/etcd/member/wal/.*$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The etcd Member Pod Specification File + Verify Permissions on the Etcd Member Pod Specification File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-pod-.*/etcd-pod.yaml$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-pod-.*/etcd-pod.yaml$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Etcd PKI Certificate Files + Verify Permissions on the Etcd PKI Certificate Files Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.crt$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-.*/secrets/.*/.*\.crt$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations + Verify Permissions on the OpenShift SDN Container Network Interface Plugin IP Address Allocations Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/lib/cni/networks/openshift-sdn/.*$ is group owned by 0. - - + This test makes sure that ^/var/lib/cni/networks/openshift-sdn/.*$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Kubernetes API Server Pod Specification File + Verify Permissions on the Kubernetes API Server Pod Specification File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-pod-.*/kube-apiserver-pod.yaml$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-pod-.*/kube-apiserver-pod.yaml$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Kubernetes Controller Manager Pod Specification File + Verify Permissions on the Kubernetes Controller Manager Pod Specificiation File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Kubernetes Scheduler Pod Specification File + Verify Permissions on The Kubelet Configuration File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$ is group owned by 0. - - + This test makes sure that /var/lib/kubelet/config.json has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Kubelet Configuration File + Verify Permissions on The Kubelet Configuration File Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/kubernetes/kubelet.conf is group owned by 0. - - + This test makes sure that /etc/kubernetes/kubelet.conf has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The OpenShift Admin Kubeconfig Files + Verify Permissions on the OpenShift Admin Kubeconfig Files Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The OpenShift Multus Container Network Interface Plugin Files + Verify Permissions on the OpenShift Multus Container Network Interface Plugin Files Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/run/multus/cni/net.d/.*$ is group owned by 0. - - + This test makes sure that ^/var/run/multus/cni/net.d/.*$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The OpenShift PKI Certificate Files + Verify Permissions on the OpenShift PKI Certificate Files Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/tls\.crt$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-.*/secrets/.*/tls\.crt$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The OpenShift PKI Private Key Files + Verify Permissions on the OpenShift PKI Private Key Files Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The OpenShift SDN CNI Server Config + Verify Permissions on the OpenShift Open vSwitch Files Red Hat OpenShift Container Platform 4 - This test makes sure that /var/run/openshift-sdn/cniserver/config.json is group owned by 0. - - + This test makes sure that /etc/openvswitch/ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + - + - + - Verify Group Who Owns The OpenShift Open vSwitch Files + Verify Permissions on the Open vSwitch Configuration Database Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/ is group owned by 0. - + This test makes sure that /etc/openvswitch/conf.db has mode 0640. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Open vSwitch Configuration Database Lock + Verify Permissions on the Open vSwitch Configuration Database Lock Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/.conf.db.~lock~ is group owned by 801. - - + This test makes sure that /etc/openvswitch/.conf.db.~lock~ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Open vSwitch Configuration Database Lock + Verify Permissions on the Open vSwitch Process ID File Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/.conf.db.~lock~ is group owned by 800. - - + This test makes sure that /var/run/openvswitch/ovs-vswitchd.pid has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Open vSwitch Configuration Database + Verify Permissions on the Open vSwitch Persistent System ID Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/conf.db is group owned by 801. - - + This test makes sure that /etc/openvswitch/system-id.conf has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Open vSwitch Configuration Database + Verify Permissions on the Open vSwitch Daemon PID File Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/conf.db is group owned by 800. - - + This test makes sure that /run/openvswitch/ovs-vswitchd.pid has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Open vSwitch Persistent System ID + Verify Permissions on the Open vSwitch Database Server PID Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/system-id.conf is group owned by 801. - - + This test makes sure that /run/openvswitch/ovsdb-server.pid has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Open vSwitch Persistent System ID + Verify Permissions on the Worker Proxy Kubeconfig File Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/system-id.conf is group owned by 800. - - + In the YAML/JSON file '/apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn' at path 'spec.template.spec.volumes[:].configMap['defaultMode','name']' at least one: key 'name' value equals 'sdn-config' and key 'defaultMode' value equals '420' + + - + + - + - Verify Group Who Owns The Kubernetes Scheduler Kubeconfig File + Verify Permissions on the Kubernetes Scheduler Pod Specification File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$ is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns the Worker Certificate Authority File + Verify Permissions on the Kubernetes Scheduler Kubeconfig File Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/kubernetes/kubelet-ca.crt is group owned by 0. - - + This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$ has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify Group Who Owns The Worker Kubeconfig File + The OpenShift etcd Data Directory Must Have Mode 0700 Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/kubelet/kubeconfig is group owned by 0. - - + This test makes sure that /var/lib/etcd/ has mode 0700. + If the target file or directory has an extended ACL, then it will fail the mode check. + + - + - + - Verify Group Who Owns The OpenShift Node Service File + Kubernetes Audit Logs Must Have Mode 0600 Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/systemd/system/kubelet.service is group owned by 0. - - + This test makes sure that ^/var/log/kube-apiserver/.+\.log$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Ensure that File Integrity Operator is scanning the cluster + OAuth Audit Logs Must Have Mode 0600 Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/fileintegrity.openshift.io/v1alpha1/fileintegrities?limit=5' at path '.items[:].metadata.name' at least one: value equals '.*' - - + This test makes sure that ^/var/log/oauth-apiserver/.+\.log$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - - + - + - Ensure the notification is enabled for file integrity operator + OpenShift Audit Logs Must Have Mode 0600 Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/monitoring.coreos.com/v1/prometheusrules?limit=500#1af9e378f0bc0282076028afdb43f9d17f4cfb2f631c4d73ce65d9d0f3b10a08' at path '[:]' at least one: value equals '.*' - - + This test makes sure that ^/var/log/openshift-apiserver/.+\.log$ has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - - + - + - Verify User Who Owns The OpenShift Container Network Interface Files + Verify Permissions on the Worker Certificate Authority File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/cni/net.d/.*$ is owned by 0. - - + This test makes sure that /etc/kubernetes/kubelet-ca.crt has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify User Who Owns The OpenShift Controller Manager Kubeconfig File + Verify Permissions on the Worker Kubeconfig File Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/configmaps/controller-manager-kubeconfig/kubeconfig$ is owned by 0. - - + This test makes sure that /var/lib/kubelet/kubeconfig has mode 0600. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify User Who Owns The Etcd Database Directory + Verify Permissions on the OpenShift Node Service File Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/etcd/member/ is owned by 0. - - + This test makes sure that /etc/systemd/system/kubelet.service has mode 0644. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify User Who Owns The Etcd Write-Ahead-Log Files + Verify Permissions on the OpenShift SDN CNI Server Config Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/lib/etcd/member/wal/.*$ is owned by 0. - - + This test makes sure that /var/run/openshift-sdn/cniserver/config.json has mode 0444. + If the target file or directory has an extended ACL, then it will fail the mode check. + + + - + - + - Verify User Who Owns The Etcd Member Pod Specification File + Ensure that FIPS mode is enabled on all cluster nodes Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-pod-.*/etcd-pod.yaml$ is owned by 0. - - + In the YAML/JSON file '/apis/machineconfiguration.openshift.io/v1/machineconfigs#ab7e02a1c3f44ae48f843ce3dee7b948d624d2f702b9428760efbfd4653847ba' at path '[:]' all: value equals 'true' + + - + + - + - Verify User Who Owns The Etcd PKI Certificate Files + Ensure that the MachineSets provisioned by GCP have disk encryption enabled Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.crt$ is owned by 0. - - + In the YAML/JSON file '/apis/machine.openshift.io/v1beta1/machinesets?limit=500#4de267a890d70235b0f43110ee972bee760ecce356b1e9cb910f99cc33a02cc2' at path '[:]' all: value equals '^.+$' + + - + + - + - Verify User Who Owns The OpenShift SDN Container Network Interface Plugin IP Address Allocations + Ensure that GitOps Operator is deployed Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/lib/cni/networks/openshift-sdn/.*$ is owned by 0. - - + In the YAML/JSON file '/apis/pipelines.openshift.io/v1alpha1/gitopsservices?limit=5' at path '.items[:].metadata.name' at least one: value equals '.*' + + - + + - + - Verify User Who Owns The Kubernetes API Server Pod Specification File + Configure An Identity Provider Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-pod-.*/kube-apiserver-pod.yaml$ is owned by 0. - - + In the YAML/JSON file '/apis/config.openshift.io/v1/oauths/cluster' at path '.spec.identityProviders[:].type' at least one: value equals '.*' + + - + + - + - Verify User Who Owns The Kubernetes Controller Manager Pod Specificiation File + Ensure that the default Ingress certificate has been replaced Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$ is owned by 0. - - + In the YAML/JSON file '/apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default' at path '.spec.defaultCertificate.name' all: value equals '.+' + - + + + - + - Verify User Who Owns The Kubernetes Scheduler Pod Specification File + Ensure that the kubeadmin secret has been removed Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$ is owned by 0. - - + In the Compliance Operator-generated file '/api/v1/namespaces/kube-system/secrets/kubeadmin' the `not found` annotation should be set + + - + + - + - Verify User Who Owns The Kubelet Configuration File + Disable Anonymous Authentication to the Kubelet Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/kubelet/config.json is owned by 0. - - + The combined kubeletconfig check + + - - + + + - + - Verify User Who Owns The Kubelet Configuration File + Disable Anonymous Authentication to the Kubelet Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/kubernetes/kubelet.conf is owned by 0. - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.authentication.anonymous.enabled' all: value equals 'false' + - + - + - Verify User Who Owns The OpenShift Admin Kubeconfig Files + Disable Anonymous Authentication to the Kubelet Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$ is owned by 0. - - + In the YAML/JSON file '/kubeletconfig/role' at path '.authentication.anonymous.enabled' all: value equals 'false' + - + + - + - Verify User Who Owns The OpenShift Multus Container Network Interface Plugin Files + Disable Anonymous Authentication to the Kubelet Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/run/multus/cni/net.d/.*$ is owned by 0. - - + In the YAML/JSON file '/kubeletconfig/role' at path '.authentication.anonymous.enabled' all: value equals 'false' + - + + - + - Verify User Who Owns The OpenShift PKI Certificate Files + Ensure authorization is set to Webhook Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/tls\.crt$ is owned by 0. - - + The combined kubeletconfig check + + - - + + + - + - Verify User Who Owns The OpenShift PKI Private Key Files + Ensure authorization is set to Webhook Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$ is owned by 0. - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.authorization.mode' all: value equals 'AlwaysAllow' + - + - + - Verify User Who Owns The OpenShift SDN CNI Server Config + Ensure authorization is set to Webhook Red Hat OpenShift Container Platform 4 - This test makes sure that /var/run/openshift-sdn/cniserver/config.json is owned by 0. - - + In the YAML/JSON file '/kubeletconfig/role' at path '.authorization.mode' all: value equals 'AlwaysAllow' + - + + - + - Verify User Who Owns The OpenShift Open vSwitch Files + Ensure authorization is set to Webhook Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/ is owned by 0. - + In the YAML/JSON file '/kubeletconfig/role' at path '.authorization.mode' all: value equals 'AlwaysAllow' + - + + - + - Verify User Who Owns The Open vSwitch Configuration Database + kubelet - Configure the Client CA Certificate Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/conf.db is owned by 800. - - + The combined kubeletconfig check + + - - + + + - + - Verify User Who Owns The Open vSwitch Configuration Database Lock + kubelet - Configure the Client CA Certificate Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/.conf.db.~lock~ is owned by 800. - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.authentication.x509.clientCAFile' all: value equals '/etc/kubernetes/kubelet-ca.crt' + - + - + - Verify User Who Owns The Open vSwitch Process ID File + kubelet - Configure the Client CA Certificate Red Hat OpenShift Container Platform 4 - This test makes sure that /var/run/openvswitch/ovs-vswitchd.pid is owned by 800. - - + In the YAML/JSON file '/kubeletconfig/role' at path '.authentication.x509.clientCAFile' all: value equals '/etc/kubernetes/kubelet-ca.crt' + - + + - + - Verify User Who Owns The Open vSwitch Persistent System ID + kubelet - Configure the Client CA Certificate Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/system-id.conf is owned by 800. - - + In the YAML/JSON file '/kubeletconfig/role' at path '.authentication.x509.clientCAFile' all: value equals '/etc/kubernetes/kubelet-ca.crt' + - + + - + - Verify User Who Owns The Open vSwitch Daemon PID File + Kubelet - Ensure Event Creation Is Configured Red Hat OpenShift Container Platform 4 - This test makes sure that /run/openvswitch/ovs-vswitchd.pid is owned by 800. - - + The combined kubeletconfig check + + - - + + + - + - Verify User Who Owns The Open vSwitch Database Server PID + Kubelet - Ensure Event Creation Is Configured Red Hat OpenShift Container Platform 4 - This test makes sure that /run/openvswitch/ovsdb-server.pid is owned by 800. - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.eventRecordQPS' all: value equals '0' + - + - + - Verify User Who Owns The Kubernetes Scheduler Kubeconfig File + Kubelet - Ensure Event Creation Is Configured Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$ is owned by 0. - - + In the YAML/JSON file '/kubeletconfig/role' at path '.eventRecordQPS' all: + - + + - + - Verify User Who Owns The OpenShift etcd Data Directory + Kubelet - Ensure Event Creation Is Configured Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/etcd/ is owned by 0. - + In the YAML/JSON file '/kubeletconfig/role' at path '.eventRecordQPS' all: + - + + - + - Verify User Who Owns the Worker Certificate Authority File + Ensure That The kubelet Client Certificate Is Correctly Set Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/kubernetes/kubelet-ca.crt is owned by 0. - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-certificate"][:]' all: value equals '(.+)' + + - + + - + - Verify User Who Owns The Worker Kubeconfig File + Ensure That The kubelet Client Certificate Is Correctly Set Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/kubelet/kubeconfig is owned by 0. - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data['config.yaml']' all: value equals '"kubelet-client-certificate":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt"\]' + + - + + - + - Verify User Who Owns The OpenShift Node Service File + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/systemd/system/kubelet.service is owned by 0. - - + The combined kubeletconfig check + + - - + + + - + - Kubernetes Audit Logs Must Be Owned By Root + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/log/kube-apiserver($|/.*$) is owned by 0. - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.tlsCipherSuites[:]' all: + - + - + - OAuth Audit Logs Must Be Owned By Root + Ensure that the Ingress Controller only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/log/oauth-apiserver($|/.*$) is owned by 0. - - + In the YAML/JSON file '/apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default' at path '.status.tlsProfile.ciphers[:]' all: value equals '^(ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-RSA-AES256-GCM-SHA384|ECDHE-RSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES256-GCM-SHA384|AES256-GCM-SHA384|AES128-GCM-SHA256)$' + - + + - + - OpenShift Audit Logs Must Be Owned By Root + Ensure that the Kubernetes API Server Operator only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/log/openshift-apiserver($|/.*$) is owned by 0. - - + In the YAML/JSON file '/apis/operator.openshift.io/v1/kubeapiservers/cluster' at path '.spec.unsupportedConfigOverrides.servingInfo.cipherSuites[:]' all: value equals '^(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_128_GCM_SHA256)$' + - + + - + - Verify Permissions on the OpenShift Container Network Interface Files + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/cni/net.d/.*$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.tlsCipherSuites[:]' all: + - + + - + - Verify Permissions on the OpenShift Controller Manager Kubeconfig File + Ensure that the OpenShift API Server Operator only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/configmaps/controller-manager-kubeconfig/kubeconfig$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/apis/operator.openshift.io/v1/openshiftapiservers/cluster' at path '.spec.unsupportedConfigOverrides.servingInfo.cipherSuites[:]' all: value equals '^(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_128_GCM_SHA256)$' + - + + - + - Verify Permissions on the Etcd Database Directory + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/etcd/member/ has mode 0700. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.tlsCipherSuites[:]' all: + - + + - + - Verify Permissions on the Etcd Write-Ahead-Log Files + Ensure That The kubelet Server Key Is Correctly Set Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/lib/etcd/member/wal/.*$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-key"][:]' all: value equals '(.+)' + + - + + - + - Verify Permissions on the Etcd Member Pod Specification File + Ensure That The kubelet Server Key Is Correctly Set Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-pod-.*/etcd-pod.yaml$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data['config.yaml']' all: value equals '"kubelet-client-key":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.key"\]' + + - + + - + - Verify Permissions on the Etcd PKI Certificate Files + kubelet - Disable the Read-Only Port Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/etcd-.*/secrets/.*/.*\.crt$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-read-only-port"][:]' all: value equals '0' + + - + + - + - Verify Permissions on the OpenShift SDN Container Network Interface Plugin IP Address Allocations + kubelet - Enable Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/lib/cni/networks/openshift-sdn/.*$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + The combined kubeletconfig check + + - - + + + - + - Verify Permissions on the Kubernetes API Server Pod Specification File + kubelet - Enable Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-pod-.*/kube-apiserver-pod.yaml$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.rotateCertificates' all: value equals 'true' + - + - + - Verify Permissions on the Kubernetes Controller Manager Pod Specificiation File + kubelet - Enable Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.rotateCertificates' all: value equals 'true' + - + + - + - Verify Permissions on The Kubelet Configuration File + kubelet - Enable Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/kubelet/config.json has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.rotateCertificates' all: value equals 'true' + - + + - + - Verify Permissions on The Kubelet Configuration File + kubelet - Enable Client Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/kubernetes/kubelet.conf has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + The combined kubeletconfig check + + - - + + + - + - Verify Permissions on the OpenShift Admin Kubeconfig Files + kubelet - Enable Client Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.featureGates.RotateKubeletClientCertificate' all: value equals 'false' + - + + - + - Verify Permissions on the OpenShift Multus Container Network Interface Plugin Files + kubelet - Enable Client Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/run/multus/cni/net.d/.*$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.featureGates.RotateKubeletClientCertificate' all: value equals 'false' + - + + - + - Verify Permissions on the OpenShift PKI Certificate Files + kubelet - Allow Automatic Firewall Configuration Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-.*/secrets/.*/tls\.crt$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + The combined kubeletconfig check + + - - + + + - + - Verify Permissions on the OpenShift PKI Private Key Files + kubelet - Allow Automatic Firewall Configuration Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.makeIPTablesUtilChains' all: value equals 'true' + - + - + - Verify Permissions on the OpenShift Open vSwitch Files + kubelet - Allow Automatic Firewall Configuration Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - + In the YAML/JSON file '/kubeletconfig/role' at path '.makeIPTablesUtilChains' all: value equals 'true' + - + + - + - Verify Permissions on the Open vSwitch Configuration Database + kubelet - Allow Automatic Firewall Configuration Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/conf.db has mode 0640. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.makeIPTablesUtilChains' all: value equals 'true' + - + + - + - Verify Permissions on the Open vSwitch Configuration Database Lock + kubelet - Enable Protect Kernel Defaults Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/.conf.db.~lock~ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.protectKernelDefaults' all: value equals 'true' + - + - + - Verify Permissions on the Open vSwitch Process ID File + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check sysctl configuration file exist Red Hat OpenShift Container Platform 4 - This test makes sure that /var/run/openvswitch/ovs-vswitchd.pid has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + This test makes sure that/etc/sysctl.d/90-kubelet.conf does exist. + - + - + - Verify Permissions on the Open vSwitch Persistent System ID + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.keys.root_maxbytes Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/openvswitch/system-id.conf has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + Check presence of kernel.keys.root_maxbytes=25000000 in /etc/sysctl.d/90-kubelet.conf + - - + + - + - Verify Permissions on the Open vSwitch Daemon PID File + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.keys.root_maxkeys Red Hat OpenShift Container Platform 4 - This test makes sure that /run/openvswitch/ovs-vswitchd.pid has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + Check presence of kernel.keys.root_maxkeys=1000000 in /etc/sysctl.d/90-kubelet.conf + - - + + - + - Verify Permissions on the Open vSwitch Database Server PID + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.panic Red Hat OpenShift Container Platform 4 - This test makes sure that /run/openvswitch/ovsdb-server.pid has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + Check presence of kernel.panic=10 in /etc/sysctl.d/90-kubelet.conf + - - + + - + - Verify Permissions on the Worker Proxy Kubeconfig File + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.panic_on_oops Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn' at path 'spec.template.spec.volumes[:].configMap['defaultMode','name']' at least one: key 'name' value equals 'sdn-config' and key 'defaultMode' value equals '420' - - + Check presence of kernel.panic_on_oops=1 in /etc/sysctl.d/90-kubelet.conf + - - - + + - + - Verify Permissions on the Kubernetes Scheduler Pod Specification File + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter vm.overcommit_memory Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + Check presence of vm.overcommit_memory=1 in /etc/sysctl.d/90-kubelet.conf + - - + + - + - Verify Permissions on the Kubernetes Scheduler Kubeconfig File + kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter vm.panic_on_oom Red Hat OpenShift Container Platform 4 - This test makes sure that ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + Check presence of kernel.panic=10 in /etc/sysctl.d/90-kubelet.conf + - - + + - + - The OpenShift etcd Data Directory Must Have Mode 0700 + kubelet - Enable Server Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/etcd/ has mode 0700. - If the target file or directory has an extended ACL, then it will fail the mode check. - - + The combined kubeletconfig check + + - - + + + - + - Kubernetes Audit Logs Must Have Mode 0600 + kubelet - Enable Server Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/log/kube-apiserver/.+\.log$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.featureGates.RotateKubeletServerCertificate' all: value equals 'true' + - + - + - OAuth Audit Logs Must Have Mode 0600 + kubelet - Enable Server Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/log/oauth-apiserver/.+\.log$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.featureGates.RotateKubeletServerCertificate' all: value equals 'true' + - + + - + - OpenShift Audit Logs Must Have Mode 0600 + kubelet - Enable Server Certificate Rotation Red Hat OpenShift Container Platform 4 - This test makes sure that ^/var/log/openshift-apiserver/.+\.log$ has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.featureGates.RotateKubeletServerCertificate' all: value equals 'true' + - + + - + - Verify Permissions on the Worker Certificate Authority File + kubelet - Do Not Disable Streaming Timeouts Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/kubernetes/kubelet-ca.crt has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + The combined kubeletconfig check + + - - + + + - + - Verify Permissions on the Worker Kubeconfig File + kubelet - Do Not Disable Streaming Timeouts Red Hat OpenShift Container Platform 4 - This test makes sure that /var/lib/kubelet/kubeconfig has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.streamingConnectionIdleTimeout' all: + - + - + - Verify Permissions on the OpenShift Node Service File + kubelet - Do Not Disable Streaming Timeouts Red Hat OpenShift Container Platform 4 - This test makes sure that /etc/systemd/system/kubelet.service has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.streamingConnectionIdleTimeout' all: + - + + - + - Verify Permissions on the OpenShift SDN CNI Server Config + kubelet - Do Not Disable Streaming Timeouts Red Hat OpenShift Container Platform 4 - This test makes sure that /var/run/openshift-sdn/cniserver/config.json has mode 0444. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - + In the YAML/JSON file '/kubeletconfig/role' at path '.streamingConnectionIdleTimeout' all: + - + + - + - Ensure that the cluster was installed with FIPS mode enabled + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/machineconfiguration.openshift.io/v1/machineconfigs/99-master-fips' at path '.spec.fips' all: value equals 'true' - - + The combined kubeletconfig check + + - - - + + + - + - Ensure that FIPS mode is enabled on all cluster nodes + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/machineconfiguration.openshift.io/v1/machineconfigs#191c7889a801949fcc07c8f067ca719c614388ea53f4b96b7148c57799e423b3' at path '[:]' all: value equals 'true' - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['imagefs.available']' all: value equals '.*' + - - + - + - Ensure that the MachineSets provisioned by GCP have disk encryption enabled + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/machine.openshift.io/v1beta1/machinesets?limit=500#4de267a890d70235b0f43110ee972bee760ecce356b1e9cb910f99cc33a02cc2' at path '[:]' all: value equals '^.+$' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['imagefs.available']' all: + - - + + - + - Ensure that GitOps Operator is deployed + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/pipelines.openshift.io/v1alpha1/gitopsservices?limit=5' at path '.items[:].metadata.name' at least one: value equals '.*' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['imagefs.available']' all: + - - + + - + - Configure An Identity Provider + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/config.openshift.io/v1/oauths/cluster' at path '.spec.identityProviders[:].type' at least one: value equals '.*' - - + The combined kubeletconfig check + + - - - + + + - + - Ensure that the default Ingress certificate has been replaced + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default' at path '.spec.defaultCertificate.name' all: value equals '.+' - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['imagefs.inodesFree']' all: value equals '.*' + - - - + - + - Ensure that the kubeadmin secret has been removed + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - In the Compliance Operator-generated file '/api/v1/namespaces/kube-system/secrets/kubeadmin' the `not found` annotation should be set - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['imagefs.inodesFree']' all: + - - + + - + - Disable Anonymous Authentication to the Kubelet + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.authentication.anonymous.enabled' all: value equals 'false' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['imagefs.inodesFree']' all: + - + + - + - Ensure authorization is set to Webhook + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.authorization.mode' all: value equals 'AlwaysAllow' - - + The combined kubeletconfig check + + - - + + + - + - kubelet - Configure the Client CA Certificate + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.authentication.x509.clientCAFile' all: value equals '/etc/kubernetes/kubelet-ca.crt' - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['memory.available']' all: value equals '.*' + - + - + - Kubelet - Ensure Event Creation Is Configured + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.eventRecordQPS' all: value equals '0' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['memory.available']' all: + - + + - + - Ensure That The kubelet Client Certificate Is Correctly Set + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-certificate"][:]' all: value equals '(.+)' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['memory.available']' all: + - - + + - + - Ensure That The kubelet Client Certificate Is Correctly Set + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data['config.yaml']' all: value equals '"kubelet-client-certificate":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt"\]' - - + The combined kubeletconfig check + + - - - + + + - + - Ensure that the Ingress Controller only makes use of Strong Cryptographic Ciphers + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default' at path '.status.tlsProfile.ciphers[:]' all: value equals '^(ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-RSA-AES256-GCM-SHA384|ECDHE-RSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES256-GCM-SHA384|AES256-GCM-SHA384|AES128-GCM-SHA256)$' - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['nodefs.available']' all: value equals '.*' + - - + - + - Ensure that the Kubernetes API Server Operator only makes use of Strong Cryptographic Ciphers + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/operator.openshift.io/v1/kubeapiservers/cluster' at path '.spec.unsupportedConfigOverrides.servingInfo.cipherSuites[:]' all: value equals '^(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_128_GCM_SHA256)$' - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['nodefs.available']' all: + - - + + - + - Ensure that the OpenShift API Server Operator only makes use of Strong Cryptographic Ciphers + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/operator.openshift.io/v1/openshiftapiservers/cluster' at path '.spec.unsupportedConfigOverrides.servingInfo.cipherSuites[:]' all: value equals '^(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_128_GCM_SHA256)$' - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['nodefs.available']' all: + - - + + - + - Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.tlsCipherSuites[:]' all: - + The combined kubeletconfig check + + - - + + + - + - Ensure That The kubelet Server Key Is Correctly Set + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-client-key"][:]' all: value equals '(.+)' - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['nodefs.inodesFree']' all: value equals '.*' + - - + - + - Ensure That The kubelet Server Key Is Correctly Set + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data['config.yaml']' all: value equals '"kubelet-client-key":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.key"\]' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['nodefs.inodesFree']' all: + - - + + - + - kubelet - Disable the Read-Only Port + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["kubelet-read-only-port"][:]' all: value equals '0' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionHard['nodefs.inodesFree']' all: + - - + + - + - kubelet - Enable Certificate Rotation + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.rotateCertificates' all: value equals 'true' - - + The combined kubeletconfig check + + - - + + + - + - kubelet - Enable Client Certificate Rotation + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.featureGates.RotateKubeletClientCertificate' all: value equals 'false' - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['imagefs.available']' all: value equals '.*' + - + - + - kubelet - Allow Automatic Firewall Configuration + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.makeIPTablesUtilChains' all: value equals 'true' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['imagefs.available']' all: + - + + - + - kubelet - Enable Protect Kernel Defaults + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.protectKernelDefaults' all: value equals 'true' - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['imagefs.available']' all: + - + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check sysctl configuration file exist + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - This test makes sure that/etc/sysctl.d/90-kubelet.conf does exist. - + The combined kubeletconfig check + + - - + + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.keys.root_maxbytes + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - Check presence of kernel.keys.root_maxbytes=25000000 in /etc/sysctl.d/90-kubelet.conf - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['imagefs.inodesFree']' all: value equals '.*' + - - + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.keys.root_maxkeys + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - Check presence of kernel.keys.root_maxkeys=1000000 in /etc/sysctl.d/90-kubelet.conf - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['imagefs.inodesFree']' all: + - - + + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.panic + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree Red Hat OpenShift Container Platform 4 - Check presence of kernel.panic=10 in /etc/sysctl.d/90-kubelet.conf - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['imagefs.inodesFree']' all: + - - + + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter kernel.panic_on_oops + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available Red Hat OpenShift Container Platform 4 - Check presence of kernel.panic_on_oops=1 in /etc/sysctl.d/90-kubelet.conf - + The combined kubeletconfig check + + - - + + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter vm.overcommit_memory + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available Red Hat OpenShift Container Platform 4 - Check presence of vm.overcommit_memory=1 in /etc/sysctl.d/90-kubelet.conf - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['memory.available']' all: value equals '.*' + - - + + - + - kubelet - Set Up Sysctl to Enable Protect Kernel Defaults - Check Parameter vm.panic_on_oom + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available Red Hat OpenShift Container Platform 4 - Check presence of kernel.panic=10 in /etc/sysctl.d/90-kubelet.conf - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['memory.available']' all: + - - + + + - + - kubelet - Enable Server Certificate Rotation + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.featureGates.RotateKubeletServerCertificate' all: value equals 'true' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['memory.available']' all: + - + + - + - kubelet - Do Not Disable Streaming Timeouts + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.streamingConnectionIdleTimeout' all: - - + The combined kubeletconfig check + + - - + + + - + - Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['imagefs.available']' all: value equals '.*' - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['nodefs.available']' all: value equals '.*' + - + - + - Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['imagefs.inodesFree']' all: value equals '.*' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['nodefs.available']' all: + - + + - + - Ensure Eviction threshold Settings Are Set - evictionHard: memory.available + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['memory.available']' all: value equals '.*' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['nodefs.available']' all: + - + + - + - Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['nodefs.available']' all: value equals '.*' - - + The combined kubeletconfig check + + - - + + + - + - Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionHard['nodefs.inodesFree']' all: value equals '.*' - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['nodefs.inodesFree']' all: value equals '.*' + - + - + - Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['imagefs.available']' all: value equals '.*' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['nodefs.inodesFree']' all: + - + + - + - Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['imagefs.inodesFree']' all: value equals '.*' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.evictionSoft['nodefs.inodesFree']' all: + - + + - + - Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available + kubelet - Ensure that the --read-only-port is secured Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['memory.available']' all: value equals '.*' - - + The combined kubeletconfig check + - - + + + - + - Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + kubelet - Ensure that the --read-only-port is secured Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['nodefs.available']' all: value equals '.*' - - + In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.readOnlyPort' all: value equals '0' + - + - + - Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + kubelet - Ensure that the --read-only-port is secured Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.evictionSoft['nodefs.inodesFree']' all: value equals '.*' - - + In the YAML/JSON file '/kubeletconfig/role' at path '.readOnlyPort' all: value equals '0' + - + + @@ -18565,39 +22723,54 @@ critical for OpenShift security. Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/etc/kubernetes/kubelet.conf' at path '.readOnlyPort' all: value equals '0' + In the YAML/JSON file '/kubeletconfig/role' at path '.readOnlyPort' all: value equals '0' - + + + + + + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + + Red Hat OpenShift Container Platform 4 + + The combined kubeletconfig check + + + + + - + - KubeletTest + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/kubeletconfig/role' at path '.enableServer' all: value equals 'true' - + In the YAML/JSON file '/kubeletconfig/role' at path '.tlsCipherSuites[:]' all: + - - + + - + - KubeletTest + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Red Hat OpenShift Container Platform 4 In the YAML/JSON file '/kubeletconfig/role' at path '.tlsCipherSuites[:]' all: - + - - + + @@ -18606,13 +22779,13 @@ critical for OpenShift security. Red Hat OpenShift Container Platform 4 - In the YAML/JSON file '/apis/machineconfiguration.openshift.io/v1/machineconfigs#136fe907b51dc9ea5011707799731b533561dab4b043f086f36c0b5c9c288414' at path '[:]' all: value equals 'true' + In the YAML/JSON file '/apis/machineconfiguration.openshift.io/v1/machineconfigs#9fab597988075d76a1c081cdc533f05623251a854b9936a08ae52cca5fc5a311' at path '[:]' all: value equals 'true' - - + + @@ -19522,21 +23695,6 @@ critical for OpenShift security. - - - Debian 9 - - Red Hat OpenShift Container Platform 4 - - - The operating system installed on the system is Debian 9 - - - - - - - Installed operating system is Fedora @@ -20044,6 +24202,21 @@ critical for OpenShift security. + + + Ubuntu 2204 + + Red Hat OpenShift Container Platform 4 + + + The operating system installed on the system is Ubuntu 2204 + + + + + + + UnionTech OS Server 20 @@ -20774,6 +24947,32 @@ critical for OpenShift security. + + + Partition /tmp exists + + Red Hat OpenShift Container Platform 4 + + + + + + + + + + + Partition /var/tmp exists + + Red Hat OpenShift Container Platform 4 + + + + + + + + Kerberos server is older than 1.17-18 @@ -21364,10 +25563,10 @@ critical for OpenShift security. - - - - + + + + @@ -22049,18 +26248,11 @@ critical for OpenShift security. - - - - - - - - + - + @@ -22101,22 +26293,78 @@ critical for OpenShift security. - + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + + + + @@ -22131,6 +26379,10 @@ critical for OpenShift security. + + + + @@ -22145,6 +26397,13 @@ critical for OpenShift security. + + + + + + + @@ -22152,10 +26411,13 @@ critical for OpenShift security. - + + + + @@ -22177,18 +26439,56 @@ critical for OpenShift security. - + + + + + + + + + + + + - - - + + + + + + + + + + + + + + + + + + + + + + + + - - - + + + + + + + + + @@ -22214,77 +26514,259 @@ critical for OpenShift security. - + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + - - - + + + + + + - - + + - - - + + + - - + + - + - + @@ -22633,9 +27115,6 @@ critical for OpenShift security. - - - @@ -22825,6 +27304,9 @@ critical for OpenShift security. + + + @@ -23017,11 +27499,17 @@ critical for OpenShift security. + + + + + + - + @@ -23332,6 +27820,9 @@ critical for OpenShift security. .apiServerArguments[:] + + oval:ssg-local_variable_api_server_bind_address:var:1 + @@ -24250,13 +28741,6 @@ critical for OpenShift security. oval:ssg-exclude_symlinks_file_perms_openshift_sdn_cniserver_config:ste:1 oval:ssg-state_file_permissionsfile_perms_openshift_sdn_cniserver_config_0_mode_0444or_stricter_:ste:1 - - - - - - .spec.fips - @@ -24307,6 +28791,20 @@ critical for OpenShift security. + + + + + + .authentication.anonymous.enabled + + + + + + + .authentication.anonymous.enabled + @@ -24314,6 +28812,20 @@ critical for OpenShift security. .authentication.anonymous.enabled + + + + + + .authorization.mode + + + + + + + .authorization.mode + @@ -24321,6 +28833,20 @@ critical for OpenShift security. .authorization.mode + + + + + + .authentication.x509.clientCAFile + + + + + + + .authentication.x509.clientCAFile + @@ -24328,6 +28854,20 @@ critical for OpenShift security. .authentication.x509.clientCAFile + + + + + + .eventRecordQPS + + + + + + + .eventRecordQPS + @@ -24352,6 +28892,13 @@ critical for OpenShift security. .data['config.yaml'] + + + + + + .tlsCipherSuites[:] + @@ -24366,6 +28913,13 @@ critical for OpenShift security. .spec.unsupportedConfigOverrides.servingInfo.cipherSuites[:] + + + + + + .tlsCipherSuites[:] + @@ -24404,6 +28958,20 @@ critical for OpenShift security. .apiServerArguments["kubelet-read-only-port"][:] + + + + + + .rotateCertificates + + + + + + + .rotateCertificates + @@ -24411,18 +28979,39 @@ critical for OpenShift security. .rotateCertificates - - + + + + + + .featureGates.RotateKubeletClientCertificate + + + - - + + .featureGates.RotateKubeletClientCertificate - - + + + + + + .makeIPTablesUtilChains + + + + + + + .makeIPTablesUtilChains + + + - - + + .makeIPTablesUtilChains @@ -24465,6 +29054,20 @@ critical for OpenShift security. ^[\s]*kernel\.panic=10[\s]*$ 1 + + + + + + .featureGates.RotateKubeletServerCertificate + + + + + + + .featureGates.RotateKubeletServerCertificate + @@ -24472,6 +29075,20 @@ critical for OpenShift security. .featureGates.RotateKubeletServerCertificate + + + + + + .streamingConnectionIdleTimeout + + + + + + + .streamingConnectionIdleTimeout + @@ -24479,6 +29096,20 @@ critical for OpenShift security. .streamingConnectionIdleTimeout + + + + + + .evictionHard['imagefs.available'] + + + + + + + .evictionHard['imagefs.available'] + @@ -24486,6 +29117,20 @@ critical for OpenShift security. .evictionHard['imagefs.available'] + + + + + + .evictionHard['imagefs.inodesFree'] + + + + + + + .evictionHard['imagefs.inodesFree'] + @@ -24493,6 +29138,20 @@ critical for OpenShift security. .evictionHard['imagefs.inodesFree'] + + + + + + .evictionHard['memory.available'] + + + + + + + .evictionHard['memory.available'] + @@ -24500,6 +29159,20 @@ critical for OpenShift security. .evictionHard['memory.available'] + + + + + + .evictionHard['nodefs.available'] + + + + + + + .evictionHard['nodefs.available'] + @@ -24507,6 +29180,20 @@ critical for OpenShift security. .evictionHard['nodefs.available'] + + + + + + .evictionHard['nodefs.inodesFree'] + + + + + + + .evictionHard['nodefs.inodesFree'] + @@ -24514,6 +29201,20 @@ critical for OpenShift security. .evictionHard['nodefs.inodesFree'] + + + + + + .evictionSoft['imagefs.available'] + + + + + + + .evictionSoft['imagefs.available'] + @@ -24521,6 +29222,20 @@ critical for OpenShift security. .evictionSoft['imagefs.available'] + + + + + + .evictionSoft['imagefs.inodesFree'] + + + + + + + .evictionSoft['imagefs.inodesFree'] + @@ -24528,6 +29243,20 @@ critical for OpenShift security. .evictionSoft['imagefs.inodesFree'] + + + + + + .evictionSoft['memory.available'] + + + + + + + .evictionSoft['memory.available'] + @@ -24535,6 +29264,20 @@ critical for OpenShift security. .evictionSoft['memory.available'] + + + + + + .evictionSoft['nodefs.available'] + + + + + + + .evictionSoft['nodefs.available'] + @@ -24542,6 +29285,20 @@ critical for OpenShift security. .evictionSoft['nodefs.available'] + + + + + + .evictionSoft['nodefs.inodesFree'] + + + + + + + .evictionSoft['nodefs.inodesFree'] + @@ -24549,6 +29306,20 @@ critical for OpenShift security. .evictionSoft['nodefs.inodesFree'] + + + + + + .readOnlyPort + + + + + + + .readOnlyPort + @@ -24556,18 +29327,18 @@ critical for OpenShift security. .readOnlyPort - - + + - - - .enableServer + + + .tlsCipherSuites[:] - - + + - - + + .tlsCipherSuites[:] @@ -24989,11 +29760,6 @@ critical for OpenShift security. ^11.[0-9]+$ 1 - - /etc/debian_version - ^9.[0-9]+$ - 1 - fedora-release.* @@ -25149,6 +29915,11 @@ critical for OpenShift security. ^DISTRIB_CODENAME=focal$ 1 + + /etc/lsb-release + ^DISTRIB_CODENAME=jammy$ + 1 + uos-release @@ -25271,6 +30042,12 @@ critical for OpenShift security. /run/.containerenv + + /tmp + + + /var/tmp + krb5-server @@ -25476,11 +30253,9 @@ critical for OpenShift security. - - - (.+) - - + + + @@ -26590,11 +31365,6 @@ critical for OpenShift security. symbolic link - - - true - - true @@ -26623,26 +31393,66 @@ critical for OpenShift security. .+ + + + false + + + + + false + + false + + + AlwaysAllow + + + + + AlwaysAllow + + AlwaysAllow + + + /etc/kubernetes/kubelet-ca.crt + + + + + /etc/kubernetes/kubelet-ca.crt + + /etc/kubernetes/kubelet-ca.crt - + 0 + + + + + + + + + + @@ -26651,6 +31461,11 @@ critical for OpenShift security. "kubelet-client-certificate":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt"\] + + + + + ^(ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-RSA-AES256-GCM-SHA384|ECDHE-RSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES256-GCM-SHA384|AES256-GCM-SHA384|AES128-GCM-SHA256)$ @@ -26661,6 +31476,11 @@ critical for OpenShift security. ^(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_128_GCM_SHA256)$ + + + + + ^(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_256_GCM_SHA384|TLS_RSA_WITH_AES_128_GCM_SHA256)$ @@ -26684,17 +31504,42 @@ critical for OpenShift security. 0 + + + true + + + + + true + + true - + + + false + + + false - + + + true + + + + + true + + + true @@ -26704,64 +31549,194 @@ critical for OpenShift security. true + + + true + + + + + true + + true - + + + + + + + + + + + + + + .* + + + + + + + + + + + + .* + + + + + + + + + + .* + + + + + + + + + + .* + + + + + + + + + + .* + + + + + + + + + + .* + + + + + + + + + + .* + + + + + + + + + + .* + + + + + + + + + + .* + + + + + + + + + + .* + + + + + - .* + + + + + + 0 + + + + + 0 @@ -26769,12 +31744,12 @@ critical for OpenShift security. 0 - + - true + - + @@ -26801,7 +31776,7 @@ critical for OpenShift security. - + @@ -27451,6 +32426,12 @@ critical for OpenShift security. /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430 + + + + + + @@ -27856,16 +32837,10 @@ critical for OpenShift security. /apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn - - - - /apis/machineconfiguration.openshift.io/v1/machineconfigs/99-master-fips - - - /apis/machineconfiguration.openshift.io/v1/machineconfigs#191c7889a801949fcc07c8f067ca719c614388ea53f4b96b7148c57799e423b3 + /apis/machineconfiguration.openshift.io/v1/machineconfigs#ab7e02a1c3f44ae48f843ce3dee7b948d624d2f702b9428760efbfd4653847ba @@ -27908,17 +32883,84 @@ critical for OpenShift security. /api/v1/namespaces/kube-system/secrets/kubeadmin + + /etc/kubernetes/kubelet.conf + + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + - /etc/kubernetes/kubelet.conf + + + /kubeletconfig/role + / + + @@ -27937,6 +32979,10 @@ critical for OpenShift security. /api/v1/namespaces/openshift-kube-apiserver/configmaps/config + + /etc/kubernetes/kubelet.conf + + @@ -27949,6 +32995,14 @@ critical for OpenShift security. /apis/operator.openshift.io/v1/kubeapiservers/cluster + + + + /kubeletconfig/role + / + + + @@ -27956,9 +33010,13 @@ critical for OpenShift security. - /etc/kubernetes/kubelet.conf + + + /kubeletconfig/role + / + + - @@ -27982,79 +33040,341 @@ critical for OpenShift security. /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430 - + /etc/kubernetes/kubelet.conf - - /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + - + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + /etc/kubernetes/kubelet.conf + + /etc/kubernetes/kubelet.conf + + + + + /kubeletconfig/role + / + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + + /kubeletconfig/role + / + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf - + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + + + + + /kubeletconfig/role + / + + + + /etc/kubernetes/kubelet.conf + + + + /kubeletconfig/role + / + + + - /etc/kubernetes/kubelet.conf + + + /kubeletconfig/role + / + + - + /kubeletconfig/role / - + - - + /kubeletconfig/role / - + - /apis/machineconfiguration.openshift.io/v1/machineconfigs#136fe907b51dc9ea5011707799731b533561dab4b043f086f36c0b5c9c288414 + /apis/machineconfiguration.openshift.io/v1/machineconfigs#9fab597988075d76a1c081cdc533f05623251a854b9936a08ae52cca5fc5a311 @@ -28082,6 +33402,7 @@ critical for OpenShift security. /apis/oauth.openshift.io/v1/oauthclients + @@ -28356,13 +33677,13 @@ critical for OpenShift security. - + build_shorthand.py from SCAP Security Guide - ssg: 0.1.64 + ssg: 0.1.65 2.0 - 2022-08-11T18:54:57 + 2022-10-18T20:06:13 @@ -28965,12 +34286,6 @@ critical for OpenShift security. ocil:ssg-ebs_encryption_enabled_on_machinesets_action:testaction:1 - - Ensure that the cluster was installed with FIPS mode enabled - - ocil:ssg-fips_mode_enabled_action:testaction:1 - - Ensure that FIPS mode is enabled on all cluster nodes @@ -29025,24 +34340,96 @@ critical for OpenShift security. ocil:ssg-reject_unsigned_images_by_default_action:testaction:1 + + Disable Anonymous Authentication to the Kubelet + + ocil:ssg-kubelet_anonymous_auth_action:testaction:1 + + + + Disable Anonymous Authentication to the Kubelet + + ocil:ssg-kubelet_anonymous_auth_deprecated_action:testaction:1 + + + + Disable Anonymous Authentication to the Kubelet + + ocil:ssg-kubelet_anonymous_auth_master_action:testaction:1 + + Disable Anonymous Authentication to the Kubelet ocil:ssg-kubelet_anonymous_auth_worker_action:testaction:1 + + Ensure authorization is set to Webhook + + ocil:ssg-kubelet_authorization_mode_action:testaction:1 + + + + Ensure authorization is set to Webhook + + ocil:ssg-kubelet_authorization_mode_deprecated_action:testaction:1 + + + + Ensure authorization is set to Webhook + + ocil:ssg-kubelet_authorization_mode_master_action:testaction:1 + + Ensure authorization is set to Webhook ocil:ssg-kubelet_authorization_mode_worker_action:testaction:1 + + kubelet - Configure the Client CA Certificate + + ocil:ssg-kubelet_configure_client_ca_action:testaction:1 + + + + kubelet - Configure the Client CA Certificate + + ocil:ssg-kubelet_configure_client_ca_deprecated_action:testaction:1 + + + + kubelet - Configure the Client CA Certificate + + ocil:ssg-kubelet_configure_client_ca_master_action:testaction:1 + + kubelet - Configure the Client CA Certificate ocil:ssg-kubelet_configure_client_ca_worker_action:testaction:1 + + Kubelet - Ensure Event Creation Is Configured + + ocil:ssg-kubelet_configure_event_creation_action:testaction:1 + + + + Kubelet - Ensure Event Creation Is Configured + + ocil:ssg-kubelet_configure_event_creation_deprecated_action:testaction:1 + + + + Kubelet - Ensure Event Creation Is Configured + + ocil:ssg-kubelet_configure_event_creation_master_action:testaction:1 + + Kubelet - Ensure Event Creation Is Configured @@ -29061,6 +34448,18 @@ critical for OpenShift security. ocil:ssg-kubelet_configure_tls_cert_pre_4_9_action:testaction:1 + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + + ocil:ssg-kubelet_configure_tls_cipher_suites_action:testaction:1 + + + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + + ocil:ssg-kubelet_configure_tls_cipher_suites_deprecated_action:testaction:1 + + Ensure that the Ingress Controller only makes use of Strong Cryptographic Ciphers @@ -29073,6 +34472,12 @@ critical for OpenShift security. ocil:ssg-kubelet_configure_tls_cipher_suites_kubeapiserver_operator_action:testaction:1 + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + + ocil:ssg-kubelet_configure_tls_cipher_suites_master_action:testaction:1 + + Ensure that the OpenShift API Server Operator only makes use of Strong Cryptographic Ciphers @@ -29103,6 +34508,24 @@ critical for OpenShift security. ocil:ssg-kubelet_disable_readonly_port_action:testaction:1 + + kubelet - Enable Certificate Rotation + + ocil:ssg-kubelet_enable_cert_rotation_action:testaction:1 + + + + kubelet - Enable Certificate Rotation + + ocil:ssg-kubelet_enable_cert_rotation_deprecated_action:testaction:1 + + + + kubelet - Enable Certificate Rotation + + ocil:ssg-kubelet_enable_cert_rotation_master_action:testaction:1 + + kubelet - Enable Certificate Rotation @@ -29115,12 +34538,42 @@ critical for OpenShift security. ocil:ssg-kubelet_enable_client_cert_rotation_action:testaction:1 + + kubelet - Enable Client Certificate Rotation + + ocil:ssg-kubelet_enable_client_cert_rotation_master_action:testaction:1 + + + + kubelet - Enable Client Certificate Rotation + + ocil:ssg-kubelet_enable_client_cert_rotation_worker_action:testaction:1 + + kubelet - Allow Automatic Firewall Configuration ocil:ssg-kubelet_enable_iptables_util_chains_action:testaction:1 + + kubelet - Allow Automatic Firewall Configuration + + ocil:ssg-kubelet_enable_iptables_util_chains_deprecated_action:testaction:1 + + + + kubelet - Allow Automatic Firewall Configuration + + ocil:ssg-kubelet_enable_iptables_util_chains_master_action:testaction:1 + + + + kubelet - Allow Automatic Firewall Configuration + + ocil:ssg-kubelet_enable_iptables_util_chains_worker_action:testaction:1 + + kubelet - Enable Protect Kernel Defaults @@ -29175,96 +34628,336 @@ critical for OpenShift security. ocil:ssg-kubelet_enable_protect_kernel_sysctl_vm_panic_on_oom_action:testaction:1 + + kubelet - Enable Server Certificate Rotation + + ocil:ssg-kubelet_enable_server_cert_rotation_action:testaction:1 + + + + kubelet - Enable Server Certificate Rotation + + ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_action:testaction:1 + + + + kubelet - Enable Server Certificate Rotation + + ocil:ssg-kubelet_enable_server_cert_rotation_master_action:testaction:1 + + kubelet - Enable Server Certificate Rotation ocil:ssg-kubelet_enable_server_cert_rotation_worker_action:testaction:1 + + kubelet - Do Not Disable Streaming Timeouts + + ocil:ssg-kubelet_enable_streaming_connections_action:testaction:1 + + + + kubelet - Do Not Disable Streaming Timeouts + + ocil:ssg-kubelet_enable_streaming_connections_deprecated_action:testaction:1 + + + + kubelet - Do Not Disable Streaming Timeouts + + ocil:ssg-kubelet_enable_streaming_connections_master_action:testaction:1 + + kubelet - Do Not Disable Streaming Timeouts ocil:ssg-kubelet_enable_streaming_connections_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_available_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_available_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_available_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_available_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_inodesfree_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_inodesfree_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_inodesfree_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree ocil:ssg-kubelet_eviction_thresholds_set_hard_imagefs_inodesfree_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_memory_available_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_memory_available_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_hard_memory_available_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: memory.available ocil:ssg-kubelet_eviction_thresholds_set_hard_memory_available_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_available_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_available_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_available_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_available_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_inodesfree_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_inodesfree_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_inodesfree_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_inodesfree_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_available_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_available_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_available_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_available_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_inodesfree_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_inodesfree_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_inodesfree_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.inodesFree ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_inodesfree_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_memory_available_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_memory_available_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_memory_available_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: memory.available ocil:ssg-kubelet_eviction_thresholds_set_soft_memory_available_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_available_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_available_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available + + ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_available_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.available ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_available_worker_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_inodesfree_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_inodesfree_deprecated_action:testaction:1 + + + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree + + ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_inodesfree_master_action:testaction:1 + + Ensure Eviction threshold Settings Are Set - evictionSoft: nodefs.inodesFree ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_inodesfree_worker_action:testaction:1 - + kubelet - Ensure that the --read-only-port is secured - ocil:ssg-kubelet_read_only_port_secured_worker_action:testaction:1 + ocil:ssg-kubelet_read_only_port_secured_action:testaction:1 - - KubeletTest + + kubelet - Ensure that the --read-only-port is secured - ocil:ssg-kubelet_test_action:testaction:1 + ocil:ssg-kubelet_read_only_port_secured_deprecated_action:testaction:1 + + + + kubelet - Ensure that the --read-only-port is secured + + ocil:ssg-kubelet_read_only_port_secured_master_action:testaction:1 + + + + kubelet - Ensure that the --read-only-port is secured + + ocil:ssg-kubelet_read_only_port_secured_worker_action:testaction:1 - KubeletTest + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers ocil:ssg-kubelet_test_cipher_action:testaction:1 + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + + ocil:ssg-kubelet_test_cipher_master_action:testaction:1 + + + + Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers + + ocil:ssg-kubelet_test_cipher_worker_action:testaction:1 + + Ensure that Audit Log Errors Emit Alerts @@ -30931,14 +36624,6 @@ critical for OpenShift security. FAIL - - - PASS - - - FAIL - - PASS @@ -31011,6 +36696,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31019,6 +36728,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31027,6 +36760,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31035,6 +36792,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31059,6 +36840,22 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31075,6 +36872,14 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + PASS @@ -31115,6 +36920,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31131,6 +36960,22 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31139,6 +36984,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31211,6 +37080,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31219,6 +37112,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31227,6 +37144,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31235,6 +37176,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31243,6 +37208,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31251,6 +37240,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31259,6 +37272,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31267,6 +37304,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31275,6 +37336,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31283,6 +37368,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31291,6 +37400,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31299,6 +37432,30 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -31307,7 +37464,7 @@ critical for OpenShift security. FAIL - + PASS @@ -31315,7 +37472,23 @@ critical for OpenShift security. FAIL - + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + + PASS @@ -31331,6 +37504,22 @@ critical for OpenShift security. FAIL + + + PASS + + + FAIL + + + + + PASS + + + FAIL + + PASS @@ -33118,11 +39307,11 @@ Make sure that there is one output named: file-integrity - Review the pod definitions in your cluster and verify that you have security -contexts defined as appropriate. OpenShift's Security Context Constraint -feature is on by default in OpenShift 4 and applied to all pods deployed. SCC -selection is determined by a combination of the values in the securityContext -and the rolebindings for the account deploying the pod. + Review the pod definitions in your cluster and verify they have appropriate +security contexts. OpenShift comes configured with default security context +constraints you can use immediately to secure pods in your cluster. For more +information on security context constraints, how to use them, and how to +build your own, please refer to the OpenShift security constraints documentation. Is it the case that SCCs in Pod definitions need review? @@ -33280,18 +39469,11 @@ with $ oc get machineset --all-namespaces -o yaml $ oc get machineset --all-namespaces -o json | jq '[.items[] | .spec.template.spec.providerSpec.value.blockDevices[0].ebs.encrypted] | map(. == true)' Make sure that the result is an array of 'true' values. Is it the case that EBS encryption is not enabled on cluster nodes? - - - - Run the following command to retrieve if the FIPS flag is enabled: -$ oc get machineconfig 99-master-fips -o jsonpath={.spec.fips} -Make sure that the result is 'true'. - Is it the case that FIPS mode is not enabled? Run the following command to retrieve if the FIPS flag is enabled: -$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|map(.spec.fips == true)' +$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.fips == true)' Make sure that the result is an array of 'true' values. Is it the case that FIPS mode is not enabled on all nodes (control plane and workers)? @@ -33307,7 +39489,7 @@ with $ oc get machineset --all-namespaces -o yaml Run the following command to retrieve if the LUKS object is configured: -$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|map(.spec.config.storage.luks[0].clevis != null)' +$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null)' Make sure that the result is an array of 'true' values. Is it the case that LUKS encryption is not enabled on worker nodes? @@ -33331,10 +39513,10 @@ This can be inspected by going through them with $ oc get machineset --all-namespaces -o yaml If not, run the following command to retrieve if the FIPS flag is enabled: -$ oc get machineconfig -o json | jq '. | [select(.items[].metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|[.[].items[].spec.fips]' +$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.fips == true)' Make sure that the result is an array of 'true' values. Then, run this next command to retrieve if LUKS encryption is enabled: -$ oc get machineconfig -o json | jq '. | [select(.items[].metadata.name | test("^[0-9]{2}-worker$|^[0-9]{2}-master$"))]|map(.spec.config.storage.luks[0].clevis != null)' +$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null)' The result must also be an array of 'true' values. Is it the case that FIPS mode is not enabled on worker nodes? @@ -33395,14 +39577,43 @@ This should look as follows: Is it the case that The default policy of image verification is not 'reject'? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep -A1 anonymous; done +The output should return enabled: false. + Is it the case that <tt>anonymous</tt> authentication is not set to <tt>false</tt>? + + + Run the following command on the kubelet node(s): $ sudo grep -A1 anonymous /etc/kubernetes/kubelet.conf The output should return enabled: false. Is it the case that <tt>anonymous</tt> authentication is not set to <tt>false</tt>? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep -A1 anonymous; done +The output should return enabled: false. + Is it the case that <tt>anonymous</tt> authentication is not set to <tt>false</tt>? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep -A1 anonymous; done +The output should return enabled: false. + Is it the case that <tt>anonymous</tt> authentication is not set to <tt>false</tt>? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | sudo grep -A1 authorization; done +Verify that the output is not set to mode: AlwaysAllow, or missing +(defaults to mode: Webhook). + Is it the case that <tt>authorization-mode</tt> is not configured to <tt>Webhook</tt>? + + + Run the following command on the kubelet node(s): $ sudo grep -A1 authorization /etc/kubernetes/kubelet.conf Verify that the output is not set to mode: AlwaysAllow, or missing @@ -33410,16 +39621,74 @@ Verify that the output is not set to mode: AlwaysAllow, or missing Is it the case that <tt>authorization-mode</tt> is not configured to <tt>Webhook</tt>? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | sudo grep -A1 authorization; done +Verify that the output is not set to mode: AlwaysAllow, or missing +(defaults to mode: Webhook). + Is it the case that <tt>authorization-mode</tt> is not configured to <tt>Webhook</tt>? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | sudo grep -A1 authorization; done +Verify that the output is not set to mode: AlwaysAllow, or missing +(defaults to mode: Webhook). + Is it the case that <tt>authorization-mode</tt> is not configured to <tt>Webhook</tt>? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep -A1 x509; done +The output should contain a configured certificate like /etc/kubernetes/kubelet-ca.crt. + Is it the case that no client CA certificate has been configured? + + + Run the following command on the kubelet node(s): $ sudo grep -A1 x509 /etc/kubernetes/kubelet.conf The output should contain a configured certificate like /etc/kubernetes/kubelet-ca.crt. Is it the case that no client CA certificate has been configured? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep -A1 x509; done +The output should contain a configured certificate like /etc/kubernetes/kubelet-ca.crt. + Is it the case that no client CA certificate has been configured? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep -A1 x509; done +The output should contain a configured certificate like /etc/kubernetes/kubelet-ca.crt. + Is it the case that no client CA certificate has been configured? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep eventRecordQPS; done +The output should return . + Is it the case that event creation limits are not configured? + + + Run the following command on the kubelet node(s): $ sudo grep eventRecordQPS /etc/kubernetes/kubelet.conf +The output should return . + Is it the case that event creation limits are not configured? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep eventRecordQPS; done +The output should return . + Is it the case that event creation limits are not configured? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep eventRecordQPS; done The output should return . Is it the case that event creation limits are not configured? @@ -33436,6 +39705,34 @@ Verify that a client certificate is configured. $ oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq -r '.apiServerArguments["kubelet-client-certificate"]' Verify that a client certificate is configured. Is it the case that the kubelet certificate is not configured? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep tlsCipherSuites; done +Verify that the set of ciphers contains only the following: + +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + + Is it the case that TLS cipher suite configuration is not configured or contains insecure ciphers? + + + + Run the following command on the kubelet node(s): +$ sudo grep tlsCipherSuites /etc/kubernetes/kubelet.conf +Verify that the set of ciphers contains only the following: + +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + + Is it the case that TLS cipher suite configuration is not configured or contains insecure ciphers? @@ -33448,6 +39745,21 @@ oc -n openshift-ingress-operator patch ingresscontroller/default --type merge -p Run the following comman on the kubelete nodes(s): oc patch kubeapiservers.operator.openshift.io cluster --type merge -p '{"spec":{"unsupportedConfigOverrides":{"servingInfo":{"cipherSuites":["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_GCM_SHA256"]} } } }' Is it the case that TLS cipher suite configuration is not configured? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep tlsCipherSuites; done +Verify that the set of ciphers contains only the following: + +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + + Is it the case that TLS cipher suite configuration is not configured or contains insecure ciphers? @@ -33458,13 +39770,15 @@ oc patch openshiftapiservers.operator.openshift.io cluster --type merge -p '{"sp Run the following command on the kubelet node(s): -$ sudo grep tlsCipherSuites /etc/kubernetes/kubelet.conf +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep tlsCipherSuites; done Verify that the set of ciphers contains only the following: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Is it the case that TLS cipher suite configuration is not configured or contains insecure ciphers? @@ -33490,16 +39804,51 @@ The output should be 0. Is it the case that the read-only port is not disabled? - + Run the following command on the kubelet node(s): $ sudo grep rotateCertificates /etc/kubernetes/kubelet.conf +The output should return nothing or true. + Is it the case that the kubelet cannot rotate client certificate? + + + + Run the following command on the kubelet node(s): +$ sudo grep rotateCertificates /etc/kubernetes/kubelet.conf +The output should return nothing or true. + Is it the case that the kubelet cannot rotate client certificate? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep rotateCertificates; done +The output should return nothing or true. + Is it the case that the kubelet cannot rotate client certificate? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep rotateCertificates; done The output should return nothing or true. Is it the case that the kubelet cannot rotate client certificate? Run the following command on the kubelet node(s): -$ sudo grep RotateKubeletClientCertificate /etc/kubernetes/kubelet.conf +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletClientCertificate; done +The output should return nothing or true. + Is it the case that the kubelet cannot rotate client certificate? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletClientCertificate; done +The output should return nothing or true. + Is it the case that the kubelet cannot rotate client certificate? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletClientCertificate; done The output should return nothing or true. Is it the case that the kubelet cannot rotate client certificate? @@ -33507,6 +39856,27 @@ The output should return nothing or true. Run the following command on the kubelet node(s): $ sudo grep makeIPTablesUtilChains /etc/kubernetes/kubelet.conf +The output should return true. + Is it the case that the kubelet cannot modify the firewall settings? + + + + Run the following command on the kubelet node(s): +$ sudo grep makeIPTablesUtilChains /etc/kubernetes/kubelet.conf +The output should return true. + Is it the case that the kubelet cannot modify the firewall settings? + + + + Run the following command on the kubelet node(s): +$ oc get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep makeIPTablesUtilChains +The output should return true. + Is it the case that the kubelet cannot modify the firewall settings? + + + + Run the following command on the kubelet node(s): +$ oc get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep makeIPTablesUtilChains The output should return true. Is it the case that the kubelet cannot modify the firewall settings? @@ -33602,91 +39972,350 @@ The output should return a value. Is it the case that the kubelet can modify kernel parameters? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletServerCertificate; done +The output should return true. + Is it the case that the kubelet cannot rotate server certificate? + + + Run the following command on the kubelet node(s): $ sudo grep RotateKubeletServerCertificate /etc/kubernetes/kubelet.conf The output should return true. Is it the case that the kubelet cannot rotate server certificate? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletServerCertificate; done +The output should return true. + Is it the case that the kubelet cannot rotate server certificate? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletServerCertificate; done +The output should return true. + Is it the case that the kubelet cannot rotate server certificate? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep streamingConnectionIdleTimeout; done +The output should return . + Is it the case that the streaming connection timeouts are not disabled? + + + Run the following command on the kubelet node(s): $ sudo grep streamingConnectionIdleTimeout /etc/kubernetes/kubelet.conf The output should return . Is it the case that the streaming connection timeouts are not disabled? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep streamingConnectionIdleTimeout; done +The output should return . + Is it the case that the streaming connection timeouts are not disabled? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep streamingConnectionIdleTimeout; done +The output should return . + Is it the case that the streaming connection timeouts are not disabled? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."imagefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_imagefs_available}}. + Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionHard</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionHard."imagefs.available"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionHard</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."imagefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_imagefs_available}}. + Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."imagefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_imagefs_available}}. + Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."imagefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionhard_imagefs_inodesfree}}. + Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionHard."imagefs.inodesFree"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."imagefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionhard_imagefs_inodesfree}}. + Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."imagefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionhard_imagefs_inodesfree}}. + Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."memory.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_memory_available}}. + Is it the case that <tt>memory.available</tt> is not set in <tt>evictionHard</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionHard."memory.available"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>memory.available</tt> is not set in <tt>evictionHard</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."memory.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_memory_available}}. + Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."memory.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_memory_available}}. + Is it the case that <tt>memory.available</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."nodefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_nodefs_available}}. + Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionHard</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionHard."nodefs.available"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionHard</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."nodefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_nodefs_available}}. + Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."nodefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionhard_nodefs_available}}. + Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."nodefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionhard_nodefs_inodesfree}}. + Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionHard."nodefs.inodesFree"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."nodefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionhard_nodefs_inodesfree}}. + Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionHard."nodefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionhard_nodefs_inodesfree}}. + Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionHard</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."imagefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_imagefs_available}}. + Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionSoft</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionSoft."imagefs.available"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionSoft</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."imagefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_imagefs_available}}. + Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."imagefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_imagefs_available}}. + Is it the case that <tt>imagefs.available</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."imagefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_imagefs_inodesfree}}. + Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionSoft."imagefs.inodesFree"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."imagefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_imagefs_inodesfree}}. + Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."imagefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_imagefs_inodesfree}}. + Is it the case that <tt>imagefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."memory.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_memory_available}}. + Is it the case that <tt>memory.available</tt> is not set in <tt>evictionSoft</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionSoft."memory.available"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>memory.available</tt> is not set in <tt>evictionSoft</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."memory.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_memory_available}}. + Is it the case that <tt>memory.available</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."memory.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_memory_available}}. + Is it the case that <tt>memory.available</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."nodefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_nodefs_available}}. + Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionSoft</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionSoft."nodefs.available"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionSoft</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."nodefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_nodefs_available}}. + Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."nodefs.available"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_nodefs_available}}. + Is it the case that <tt>nodefs.available</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."nodefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_nodefs_inodesfree}}. + Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? + + + Run the following command on the kubelet node(s): $ oc debug -q node/$NODE -- jq -r '.evictionSoft."nodefs.inodesFree"' /host/etc/kubernetes/kubelet.conf and make sure it outputs a value. Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? - + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."nodefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_nodefs_inodesfree}}. + Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .evictionSoft."nodefs.inodesFree"'; done +and make sure it outputs {{.var_kubelet_evictionsoft_nodefs_inodesfree}}. + Is it the case that <tt>nodefs.inodesFree</tt> is not set in <tt>evictionSoft</tt> section? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep readOnlyPort; done +and make sure it outputs 0. + Is it the case that readOnlyPort is not secured? + + + First, SSH to the relevant node. Open the Kubelet config file: @@ -33697,18 +40326,63 @@ Verify that the "readOnlyPort" argument exists and is set to 0 Is it the case that readOnlyPort is not secured? - + Run the following command on the kubelet node(s): -$ oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq -r '.apiServerArguments["kubelet-client-certificate"]' -Verify that a client certificate is configured. - Is it the case that the kubelet certificate is not configured? +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep readOnlyPort; done +and make sure it outputs 0. + Is it the case that readOnlyPort is not secured? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep readOnlyPort; done +and make sure it outputs 0. + Is it the case that readOnlyPort is not secured? Run the following command on the kubelet node(s): -$ oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq -r '.apiServerArguments["kubelet-client-certificate"]' -Verify that a client certificate is configured. - Is it the case that the kubelet certificate is not configured? +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep tlsCipherSuites; done +Verify that the set of ciphers contains only the following: + +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + + Is it the case that TLS cipher suite configuration is not configured or contains insecure ciphers? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep tlsCipherSuites; done +Verify that the set of ciphers contains only the following: + +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + + Is it the case that TLS cipher suite configuration is not configured or contains insecure ciphers? + + + + Run the following command on the kubelet node(s): +$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep tlsCipherSuites; done +Verify that the set of ciphers contains only the following: + +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + + Is it the case that TLS cipher suite configuration is not configured or contains insecure ciphers? @@ -33910,30 +40584,27 @@ If properly configured, the output should indicate the following permissions: - Run the following command to determine if /var/log/kube-apiserver -is on its own partition or logical volume: -$ mount | grep "on /var/log/kube-apiserver" -If /var/log/kube-apiserver has its own partition or volume group, a line will be returned. + Verify that a separate file system/partition has been created for /var/log/kube-apiserver with the following command: - Is it the case that no line is returned? +$ mountpoint /var/log/kube-apiserver + + Is it the case that "/var/log/kube-apiserver is not a mountpoint" is returned? - Run the following command to determine if /var/log/oauth-apiserver -is on its own partition or logical volume: -$ mount | grep "on /var/log/oauth-apiserver" -If /var/log/oauth-apiserver has its own partition or volume group, a line will be returned. + Verify that a separate file system/partition has been created for /var/log/oauth-apiserver with the following command: - Is it the case that no line is returned? +$ mountpoint /var/log/oauth-apiserver + + Is it the case that "/var/log/oauth-apiserver is not a mountpoint" is returned? - Run the following command to determine if /var/log/openshift-apiserver -is on its own partition or logical volume: -$ mount | grep "on /var/log/openshift-apiserver" -If /var/log/openshift-apiserver has its own partition or volume group, a line will be returned. + Verify that a separate file system/partition has been created for /var/log/openshift-apiserver with the following command: - Is it the case that no line is returned? +$ mountpoint /var/log/openshift-apiserver + + Is it the case that "/var/log/openshift-apiserver is not a mountpoint" is returned? @@ -36104,13 +42775,13 @@ If properly configured, the output should indicate the following permissions: - + combine_ovals.py from SCAP Security Guide - ssg: [0, 1, 64], python: 3.10.6 + ssg: [0, 1, 65], python: 3.10.4 5.11 - 2022-08-11T18:54:56 + 2022-10-18T20:06:08 @@ -36229,20 +42900,6 @@ If properly configured, the output should indicate the following permissions: - - - Debian 9 - - Red Hat OpenShift Container Platform 4 - - - The operating system installed on the system is Debian 9 - - - - - - Installed operating system is Fedora @@ -36719,6 +43376,20 @@ If properly configured, the output should indicate the following permissions: + + + Ubuntu 2204 + + Red Hat OpenShift Container Platform 4 + + + The operating system installed on the system is Ubuntu 2204 + + + + + + UnionTech OS Server 20 @@ -37399,6 +44070,30 @@ If properly configured, the output should indicate the following permissions: + + + Partition /tmp exists + + Red Hat OpenShift Container Platform 4 + + + + + + + + + + Partition /var/tmp exists + + Red Hat OpenShift Container Platform 4 + + + + + + + Kerberos server is older than 1.17-18 @@ -37578,9 +44273,6 @@ If properly configured, the output should indicate the following permissions: - - - @@ -37770,6 +44462,9 @@ If properly configured, the output should indicate the following permissions: + + + @@ -37962,11 +44657,17 @@ If properly configured, the output should indicate the following permissions: + + + + + + - + @@ -38039,11 +44740,6 @@ If properly configured, the output should indicate the following permissions: ^11.[0-9]+$ 1 - - /etc/debian_version - ^9.[0-9]+$ - 1 - fedora-release.* @@ -38199,6 +44895,11 @@ If properly configured, the output should indicate the following permissions: ^DISTRIB_CODENAME=focal$ 1 + + /etc/lsb-release + ^DISTRIB_CODENAME=jammy$ + 1 + uos-release @@ -38321,6 +45022,12 @@ If properly configured, the output should indicate the following permissions: /run/.containerenv + + /tmp + + + /var/tmp + krb5-server @@ -38641,12 +45348,6 @@ If properly configured, the output should indicate the following permissions: - - /kubernetes-api-resources/apis/apiextensions.k8s.io/v1/customresourcedefinitions/hostedclusters.hypershift.openshift.io - - - /kubernetes-api-resources/apis/config.openshift.io/v1/infrastructures/cluster - /etc/kubernetes/cni/net.d/00-multus.conf @@ -38656,6 +45357,12 @@ If properly configured, the output should indicate the following permissions: /kubernetes-api-resources/apis/config.openshift.io/v1/clusteroperators/openshift-apiserver + + /kubernetes-api-resources/apis/apiextensions.k8s.io/v1/customresourcedefinitions/hostedclusters.hypershift.openshift.io + + + /kubernetes-api-resources/apis/config.openshift.io/v1/infrastructures/cluster + diff --git a/images/testcontent/kubelet_default/ssg-rhcos4-ds.xml b/images/testcontent/kubelet_default/ssg-rhcos4-ds.xml deleted file mode 100644 index 994645a6d..000000000 --- a/images/testcontent/kubelet_default/ssg-rhcos4-ds.xml +++ /dev/null @@ -1,112545 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - System architecture is AARCH64 - oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1 - - - Package audit is installed - oval:ssg-installed_env_has_audit_package:def:1 - - - Package chrony is installed - oval:ssg-installed_env_has_chrony_package:def:1 - - - Package gdm is installed - oval:ssg-installed_env_has_gdm_package:def:1 - - - Package grub2 is installed - oval:ssg-installed_env_has_grub2_package:def:1 - - - Package providing /etc/login.defs is installed - oval:ssg-installed_env_has_login_defs:def:1 - - - Bare-metal or Virtual Machine - oval:ssg-installed_env_is_a_machine:def:1 - - - System boot mode is non-UEFI - oval:ssg-system_boot_mode_is_non_uefi:def:1 - - - System architecture is not S390X - oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1 - - - Package ntp is installed - oval:ssg-installed_env_has_ntp_package:def:1 - - - Package pam is installed - oval:ssg-installed_env_has_pam_package:def:1 - - - Package polkit is installed - oval:ssg-installed_env_has_polkit_package:def:1 - - - Package postfix is installed - oval:ssg-installed_env_has_postfix_package:def:1 - - - System architecture is S390X - oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1 - - - Package sssd-common is installed - oval:ssg-installed_env_has_sssd-common_package:def:1 - - - Package sudo is installed - oval:ssg-installed_env_has_sudo_package:def:1 - - - Package systemd is installed - oval:ssg-installed_env_has_systemd_package:def:1 - - - Package tmux is installed - oval:ssg-installed_env_has_tmux_package:def:1 - - - System boot mode is UEFI - oval:ssg-system_boot_mode_is_uefi:def:1 - - - Package usbguard is installed - oval:ssg-installed_env_has_usbguard_package:def:1 - - - WiFi interface is present - oval:ssg-installed_env_has_wifi_interface:def:1 - - - Red Hat Enterprise Linux CoreOS 4 - oval:ssg-installed_OS_is_rhcos4:def:1 - - - - - - draft - Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4 - This guide presents a catalog of security-relevant -configuration settings for Red Hat Enterprise Linux CoreOS 4. It is a rendering of -content structured in the eXtensible Configuration Checklist Description Format (XCCDF) -in order to support security automation. The SCAP content is -is available in the scap-security-guide package which is developed at - - https://www.open-scap.org/security-policies/scap-security-guide. - -Providing system administrators with such guidance informs them how to securely -configure systems under their control in a variety of network roles. Policy -makers and baseline creators can use this catalog of settings, with its -associated references to higher-level security control catalogs, in order to -assist them in security baseline creation. This guide is a catalog, not a -checklist, and satisfaction of every item is not likely to be possible or -sensible in many operational scenarios. However, the XCCDF format enables -granular selection and adjustment of settings, and their association with OVAL -and OCIL content provides an automated checking capability. Transformations of -this document, and its associated automated checking content, are capable of -providing baselines that meet a diverse set of policy objectives. Some example -XCCDF Profiles, which are selections of items that form checklists and -can be used as baselines, are available with this guide. They can be -processed, in an automated fashion, with tools that support the Security -Content Automation Protocol (SCAP). The DISA STIG, which provides required -settings for US Department of Defense systems, is one example of a baseline -created from this guidance. - - Do not attempt to implement any of the settings in -this guide without first testing them in a non-operational environment. The -creators of this guidance assume no responsibility whatsoever for its use by -other parties, and makes no guarantees, expressed or implied, about its -quality, reliability, or any other characteristic. - - The SCAP Security Guide Project - - https://www.open-scap.org/security-policies/scap-security-guide - - Red Hat and Red Hat Enterprise Linux are either registered -trademarks or trademarks of Red Hat, Inc. in the United States and other -countries. All other names are registered trademarks or trademarks of their -respective companies. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0.1.64 - - SCAP Security Guide Project - SCAP Security Guide Project - Frank J Cameron (CAM1244) <cameron@ctc.com> - 0x66656c6978 <0x66656c6978@users.noreply.github.com> - Håvard F. Aasen <havard.f.aasen@pfft.no> - Jack Adolph <jack.adolph@gmail.com> - Edgar Aguilar <edgar.aguilar@oracle.com> - Gabe Alford <redhatrises@gmail.com> - Firas AlShafei <firas.alshafei@us.abb.com> - Rodrigo Alvares <ralvares@redhat.com> - Christopher Anderson <cba@fedoraproject.org> - angystardust <angystardust@users.noreply.github.com> - anivan-suse <anastasija.ivanovic@suse.com> - anixon-rh <55244503+anixon-rh@users.noreply.github.com> - Ikko Ashimine <eltociear@gmail.com> - Chuck Atkins <chuck.atkins@kitware.com> - ayfantis <ayfantis@localhost.localdomain> - Ryan Ballanger <root@rballang-admin-2.fastenal.com> - Alex Baranowski <alex@euro-linux.com> - Eduardo Barretto <eduardo.barretto@canonical.com> - Molly Jo Bault <Molly.Jo.Bault@ballardtech.com> - Andrew Becker <A-Beck@users.noreply.github.com> - Gabriel Becker <ggasparb@redhat.com> - Alexander Bergmann <abergmann@suse.com> - Dale Bewley <dale@bewley.net> - Jose Luis BG <bgjoseluis@gmail.com> - binyanling <binyanling@uniontech.com> - Joseph Bisch <joseph.bisch@gmail.com> - Jeffrey Blank <blank@eclipse.ncsc.mil> - Olivier Bonhomme <ptitoliv@ptitoliv.net> - Lance Bragstad <lbragstad@gmail.com> - Ted Brunell <tbrunell@redhat.com> - Marcus Burghardt <maburgha@redhat.com> - Matthew Burket <mburket@redhat.com> - Blake Burkhart <blake.burkhart@us.af.mil> - Patrick Callahan <pmc@patrickcallahan.com> - George Campbell <gcampbell@palantir.com> - Nick Carboni <ncarboni@redhat.com> - Carlos <64919342+carlosmmatos@users.noreply.github.com> - James Cassell <james.cassell@ll.mit.edu> - Frank Caviggia <fcaviggi@ra.iad.redhat.com> - Eric Christensen <echriste@redhat.com> - Dan Clark <danclark@redhat.com> - Jayson Cofell <1051437+70k10@users.noreply.github.com> - Caleb Cooper <coopercd@ornl.gov> - Richard Maciel Costa <richard.maciel.costa@canonical.com> - Deric Crago <deric.crago@gmail.com> - crleekwc <crleekwc@gmail.com> - cyarbrough76 <42849651+cyarbrough76@users.noreply.github.com> - Maura Dailey <maura@eclipse.ncsc.mil> - Klaas Demter <demter@atix.de> - dhanushkar-wso2 <dhanushkar@wso2.com> - Andrew DiPrinzio <andrew.diprinzio@jhuapl.edu> - dom <dominique.blaze@devinci.fr> - Jean-Baptiste Donnette <jean-baptiste.donnette@epita.fr> - Marco De Donno <mdedonno1337@gmail.com> - dperrone <dperrone@redhat.com> - drax <applezip@gmail.com> - Sebastian Dunne <sdunne@redhat.com> - François Duthilleul <francoisduthilleul@gmail.com> - Greg Elin <gregelin@gitmachines.com> - eradot4027 <jrtonmac@gmail.com> - Alexis Facques <alexis.facques@mythalesgroup.io> - Leah Fisher <lfisher047@gmail.com> - Yavor Georgiev <strandjata@gmail.com> - Alijohn Ghassemlouei <alijohn@secureagc.com> - Swarup Ghosh <swghosh@redhat.com> - ghylock <ghylock@gmail.com> - Andrew Gilmore <agilmore2@gmail.com> - Joshua Glemza <jglemza@nasa.gov> - Nick Gompper <forestgomp@yahoo.com> - Loren Gordon <lorengordon@users.noreply.github.com> - Patrik Greco <sikevux@sikevux.se> - Steve Grubb <sgrubb@redhat.com> - guangyee <gyee@suse.com> - Marek Haicman <mhaicman@redhat.com> - Vern Hart <vern.hart@canonical.com> - Alex Haydock <alex@alexhaydock.co.uk> - Rebekah Hayes <rhayes@corp.rivierautilities.com> - Trey Henefield <thenefield@gmail.com> - Henning Henkel <henning.henkel@helvetia.ch> - hex2a <hex2a@users.noreply.github.com> - John Hooks <jhooks@starscream.pa.jhbcomputers.com> - Jakub Hrozek <jhrozek@redhat.com> - De Huo <De.Huo@windriver.com> - Robin Price II <robin@redhat.com> - Yasir Imam <yimam@redhat.com> - Jiri Jaburek <jjaburek@redhat.com> - Keith Jackson <keithkjackson@gmail.com> - Jeremiah Jahn <jeremiah@goodinassociates.com> - Jakub Jelen <jjelen@redhat.com> - Jessicahfy <Jessicahfy@users.noreply.github.com> - Stephan Joerrens <Stephan.Joerrens@fiduciagad.de> - Hunter Jones <hjones2199@gmail.com> - Jono <jono@ubuntu-18.localdomain> - justchris1 <justchris1@justchris1.email> - Kai Kang <kai.kang@windriver.com> - Charles Kernstock <charles.kernstock@ultra-ats.com> - Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com> - Sherine Khoury <skhoury@redhat.com> - Nathan Kinder <nkinder@redhat.com> - Lee Kinser <lee.kinser@gmail.com> - Evgeny Kolesnikov <ekolesni@redhat.com> - Peter 'Pessoft' Kolínek <github@pessoft.com> - Luke Kordell <luke.t.kordell@lmco.com> - Malte Kraus <malte.kraus@suse.com> - Seth Kress <seth.kress@dsainc.com> - Felix Krohn <felix.krohn@helvetia.ch> - kspargur <kspargur@kspargur.csb> - Amit Kumar <amitkuma@redhat.com> - Fen Labalme <fen@civicactions.com> - Ade Lee <alee@redhat.com> - Christopher Lee <Crleekwc@gmail.com> - Ian Lee <lee1001@llnl.gov> - Jarrett Lee <jarrettl@umd.edu> - Joseph Lenox <joseph.lenox@collins.com> - Jan Lieskovsky <jlieskov@redhat.com> - Markus Linnala <Markus.Linnala@knowit.fi> - Šimon Lukašík <slukasik@redhat.com> - Milan Lysonek <mlysonek@redhat.com> - Fredrik Lysén <fredrik@pipemore.se> - Caitlin Macleod <caitelatte@gmail.com> - Nick Maludy <nmaludy@gmail.com> - Lokesh Mandvekar <lsm5@fedoraproject.org> - Matus Marhefka <mmarhefk@redhat.com> - Jamie Lorwey Martin <jlmartin@redhat.com> - Carlos Matos <cmatos@redhat.com> - Robert McAllister <rmcallis@redhat.com> - Karen McCarron <kmccarro@redhat.com> - Michael McConachie <michael@redhat.com> - Marcus Meissner <meissner@suse.de> - Khary Mendez <kmendez@redhat.com> - Rodney Mercer <rmercer@harris.com> - mgjadoul <mgjadoul@laptomatic.auth-o-matic.corp> - Matt Micene <nzwulfin@gmail.com> - Brian Millett <bmillett@gmail.com> - Takuya Mishina <tmishina@jp.ibm.com> - Mixer9 <35545791+Mixer9@users.noreply.github.com> - mmosel <mmosel@kde.example.com> - Zbynek Moravec <zmoravec@redhat.com> - Kazuo Moriwaka <moriwaka@users.noreply.github.com> - Michael Moseley <michael@eclipse.ncsc.mil> - Renaud Métrich <rmetrich@redhat.com> - Joe Nall <joe@nall.com> - Neiloy <neiloy@redhat.com> - Axel Nennker <axel@nennker.de> - Michele Newman <mnewman@redhat.com> - Sean O'Keeffe <seanokeeffe797@gmail.com> - Jiri Odehnal <jodehnal@redhat.com> - Ilya Okomin <ilya.okomin@oracle.com> - Kaustubh Padegaonkar <theTuxRacer@gmail.com> - Michael Palmiotto <mpalmiotto@tresys.com> - Eryx Paredes <eryxp@lyft.com> - Max R.D. Parmer <maxp@trystero.is> - Arnaud Patard <apatard@hupstream.com> - Jan Pazdziora <jpazdziora@redhat.com> - pcactr <paul.c.arnold4.ctr@mail.mil> - Kenneth Peeples <kennethwpeeples@gmail.com> - Nathan Peters <Nathaniel.Peters@ca.com> - Frank Lin PIAT <fpiat@klabs.be> - Stefan Pietsch <mail.ipv4v6+gh@gmail.com> - piggyvenus <piggyvenus@gmail.com> - Vojtech Polasek <vpolasek@redhat.com> - Orion Poplawski <orion@nwra.com> - Nick Poyant <npoyant@redhat.com> - Martin Preisler <mpreisle@redhat.com> - Wesley Ceraso Prudencio <wcerasop@redhat.com> - Raphael Sanchez Prudencio <rsprudencio@redhat.com> - T.O. Radzy Radzykewycz <radzy@windriver.com> - Kenyon Ralph <kenyon@kenyonralph.com> - Mike Ralph <mralph@redhat.com> - Federico Ramirez <federico.r.ramirez@oracle.com> - rchikov <rumen.chikov@suse.com> - Rick Renshaw <Richard_Renshaw@xtoenergy.com> - Chris Reynolds <c.reynolds82@gmail.com> - rhayes <rhayes@rivierautilities.com> - Pat Riehecky <riehecky@fnal.gov> - rlucente-se-jboss <rlucente@redhat.com> - Juan Antonio Osorio Robles <juan.osoriorobles@eu.equinix.com> - Matt Rogers <mrogers@redhat.com> - Jesse Roland <jesse.roland@onyxpoint.com> - Joshua Roys <roysjosh@gmail.com> - rrenshaw <bofh69@yahoo.com> - Chris Ruffalo <chris.ruffalo@gmail.com> - rumch-se <77793453+rumch-se@users.noreply.github.com> - Ray Shaw (Cont ARL/CISD) rvshaw <rvshaw@esme.arl.army.mil> - Earl Sampson <ESampson@suse.com> - sampsone <esampson@suse.com> - Willy Santos <wsantos@redhat.com> - Nagarjuna Sarvepalli <snagarju@redhat.com> - Anderson Sasaki <33833274+ansasaki@users.noreply.github.com> - Gautam Satish <gautams@hpe.com> - Watson Sato <wsato@redhat.com> - Satoru SATOH <satoru.satoh@gmail.com> - Alexander Scheel <ascheel@redhat.com> - Bryan Schneiders <pschneiders@trisept.com> - shaneboulden <shane.boulden@gmail.com> - Vincent Shen <47534281+Vincent056@users.noreply.github.com> - Dhriti Shikhar <dhriti.shikhar.rokz@gmail.com> - Spencer Shimko <sshimko@tresys.com> - Mark Shoger <mshoger@redhat.com> - THOBY Simon <Simon.THOBY@viveris.fr> - Thomas Sjögren <konstruktoid@users.noreply.github.com> - Francisco Slavin <fslavin@tresys.com> - David Smith <dsmith@eclipse.ncsc.mil> - Kevin Spargur <kspargur@redhat.com> - Kenneth Stailey <kstailey.lists@gmail.com> - Leland Steinke <leland.j.steinke.ctr@mail.mil> - Justin Stephenson <jstephen@redhat.com> - Brian Stinson <brian@bstinson.com> - Jake Stookey <jakestookey@gmail.com> - Jonathan Sturges <jsturges@redhat.com> - Ian Tewksbury <itewk@redhat.com> - Philippe Thierry <phil@reseau-libre.net> - Derek Thurston <thegrit@gmail.com> - tianzhenjia <jiatianzhen@cmss.chinamobile.com> - Greg Tinsley <gtinsley@redhat.com> - Paul Tittle <ptittle@cmf.nrl.navy.mil> - tom <tom@localhost.localdomain> - tomas.hudik <tomas.hudik@embedit.cz> - Jeb Trayer <jeb.d.trayer@uscg.mil> - TrilokGeer <tgeer@redhat.com> - Viktors Trubovics <viktors.trubovics@suse.com> - Nico Truzzolino <nico.truzzolino@gmx.de> - Brian Turek <brian.turek@gmail.com> - Matěj Týč <matyc@redhat.com> - VadimDor <29509093+VadimDor@users.noreply.github.com> - Trevor Vaughan <tvaughan@onyxpoint.com> - vtrubovics <82443408+vtrubovics@users.noreply.github.com> - Samuel Warren <swarren@redhat.com> - wcushen <54533890+wcushen@users.noreply.github.com> - Shawn Wells <shawn@shawndwells.io> - Daniel E. White <linuxdan@users.noreply.github.com> - Bernhard M. Wiedemann <bwiedemann@suse.de> - Roy Williams <roywilli@roywilli.redhat.com> - Willumpie <willumpie@xs4all.nl> - Rob Wilmoth <rwilmoth@redhat.com> - Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - Xirui Yang <xirui.yang@oracle.com> - yarunachalam <yarunachalam@suse.com> - Guang Yee <guang.yee@suse.com> - Achilleas John Yfantis <ayfantis@redhat.com> - YiLin.Li <YiLin.Li@linux.alibaba.com> - YuQing <yyq0391@163.com> - Kevin Zimmerman <kevin.zimmerman@kitware.com> - Luigi Mario Zuccarelli <luzuccar@redhat.com> - Jan Černý <jcerny@redhat.com> - Michal Šrubař <msrubar@redhat.com> - https://github.com/ComplianceAsCode/content/releases/latest - - - DRAFT - ANSSI-BP-028 (enhanced) - This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level. - -ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. - -A copy of the ANSSI-BP-028 can be found at the ANSSI website: -https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - DRAFT - ANSSI-BP-028 (high) - This profile contains configurations that align to ANSSI-BP-028 at the high hardening level. - -ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. - -A copy of the ANSSI-BP-028 can be found at the ANSSI website: -https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - DRAFT - ANSSI-BP-028 (intermediary) - This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level. - -ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. - -A copy of the ANSSI-BP-028 can be found at the ANSSI website: -https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - DRAFT - ANSSI-BP-028 (minimal) - This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level. - -ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. - -A copy of the ANSSI-BP-028 can be found at the ANSSI website: -https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Australian Cyber Security Centre (ACSC) Essential Eight - This profile contains configuration checks for Red Hat Enterprise Linux CoreOS -that align to the Australian Cyber Security Centre (ACSC) Essential Eight. - -A copy of the Essential Eight in Linux Environments guide can be found at the -ACSC website: - -https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers - https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - NIST 800-53 High-Impact Baseline for Red Hat Enterprise Linux CoreOS - This compliance profile reflects the core set of High-Impact Baseline -configuration settings for deployment of Red Hat Enterprise -Linux CoreOS into U.S. Defense, Intelligence, and Civilian agencies. -Development partners and sponsors include the U.S. National Institute -of Standards and Technology (NIST), U.S. Department of Defense, -the National Security Agency, and Red Hat. - -This baseline implements configuration requirements from the following -sources: - -- NIST 800-53 control selections for High-Impact systems (NIST 800-53) - -For any differing configuration requirements, e.g. password lengths, the stricter -security setting was chosen. Security Requirement Traceability Guides (RTMs) and -sample System Security Configuration Guides are provided via the -scap-security-guide-docs package. - -This profile reflects U.S. Government consensus content and is developed through -the ComplianceAsCode initiative, championed by the National -Security Agency. Except for differences in formatting to accommodate -publishing processes, this profile mirrors ComplianceAsCode -content as minor divergences, such as bugfixes, work through the -consensus and release processes. - https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/controls?version=5.1&security_baseline=High - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - NIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS - This compliance profile reflects the core set of Moderate-Impact Baseline -configuration settings for deployment of Red Hat Enterprise -Linux CoreOS into U.S. Defense, Intelligence, and Civilian agencies. -Development partners and sponsors include the U.S. National Institute -of Standards and Technology (NIST), U.S. Department of Defense, -the National Security Agency, and Red Hat. - -This baseline implements configuration requirements from the following -sources: - -- NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53) - -For any differing configuration requirements, e.g. password lengths, the stricter -security setting was chosen. Security Requirement Traceability Guides (RTMs) and -sample System Security Configuration Guides are provided via the -scap-security-guide-docs package. - -This profile reflects U.S. Government consensus content and is developed through -the ComplianceAsCode initiative, championed by the National -Security Agency. Except for differences in formatting to accommodate -publishing processes, this profile mirrors ComplianceAsCode -content as minor divergences, such as bugfixes, work through the -consensus and release processes. - https://nvd.nist.gov/800-53/Rev4/impact/moderate - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for Red Hat Enterprise Linux CoreOS - This compliance profile reflects a set of security recommendations for -the usage of Red Hat Enterprise Linux CoreOS in critical -infrastructure in the energy sector. This follows the recommendations -coming from the following CIP standards: - -- CIP-002-5 -- CIP-003-8 -- CIP-004-6 -- CIP-005-6 -- CIP-007-3 -- CIP-007-6 -- CIP-009-6 - https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - System Settings - Contains rules that check correct system settings. - - Installing and Maintaining Software - The following sections contain information on -security-relevant choices during the initial operating system -installation process and the setup of software -updates. - - Prefer to use a 64-bit Operating System when supported - Prefer installation of 64-bit operating systems when the CPU supports it. - There is no remediation besides installing a 64-bit operating system. - BP28(R10) - Use of a 64-bit operating system offers a few advantages, like a larger address space range for -Address Space Layout Randomization (ASLR) and systematic presence of No eXecute and Execute Disable (NX/XD) protection bits. - - - - - - - - - System and Software Integrity - System and software integrity can be gained by installing antivirus, increasing -system encryption strength with FIPS, verifying installed software, enabling SELinux, -installing an Intrusion Prevention System, etc. However, installing or enabling integrity -checking tools cannot prevent intrusions, but they can detect that an intrusion -may have occurred. Requirements for integrity checking may be highly dependent on -the environment in which the system will be used. Snapshot-based approaches such -as AIDE may induce considerable overhead in the presence of frequent software updates. - - Disable Prelinking - The prelinking feature changes binaries in an attempt to decrease their startup -time. In order to disable it, change or add the following line inside the file -/etc/sysconfig/prelink: -PRELINKING=no -Next, run the following command to return binaries to a normal, non-prelinked state: -$ sudo /usr/sbin/prelink -ua - 11 - 13 - 14 - 2 - 3 - 9 - 5.10.1.3 - APO01.06 - BAI02.01 - BAI03.05 - BAI06.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS04.07 - DSS05.03 - DSS06.02 - DSS06.06 - 3.13.11 - CCI-000803 - CCI-002450 - 4.3.4.3.2 - 4.3.4.3.3 - 4.3.4.4.4 - SR 3.1 - SR 3.3 - SR 3.4 - SR 3.8 - SR 4.1 - SR 7.6 - A.11.2.4 - A.12.1.2 - A.12.2.1 - A.12.5.1 - A.12.6.2 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.3 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-13 - CM-6(a) - PR.DS-1 - PR.DS-6 - PR.DS-8 - PR.IP-1 - Req-11.5 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Because the prelinking feature changes binaries, it can interfere with the -operation of certain software and/or modes such as AIDE, FIPS, etc. - - - - - - Software Integrity Checking - Both the AIDE (Advanced Intrusion Detection Environment) -software and the RPM package management system provide -mechanisms for verifying the integrity of installed software. -AIDE uses snapshots of file metadata (such as hashes) and compares these -to current system files in order to detect changes. - -The RPM package management system can conduct integrity -checks by comparing information in its metadata database with -files installed on the system. - - Integrity Scan Notification Email Address - Specify the email address for designated personnel if baseline -configurations are changed in an unauthorized manner. - root@localhost - - - Verify Integrity with RPM - The RPM package management system includes the ability -to verify the integrity of installed packages by comparing the -installed files with information about the files taken from the -package metadata stored in the RPM database. Although an attacker -could corrupt the RPM database (analogous to attacking the AIDE -database as described above), this check can still reveal -modification of important files. To list which files on the system differ from what is expected by the RPM database: -$ rpm -qVa -See the man page for rpm to see a complete explanation of each column. - - Verify and Correct Ownership with RPM - The RPM package management system can check file ownership -permissions of installed software packages, including many that are -important to system security. After locating a file with incorrect -permissions, which can be found with -rpm -Va | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }' -run the following command to determine which package owns it: -$ rpm -qf FILENAME -Next, run the following command to reset its permissions to -the correct values: -$ sudo rpm --setugids PACKAGENAME - Profiles may require that specific files be owned by root while the default owner defined -by the vendor is different. -Such files will be reported as a finding and need to be evaluated according to your policy -and deployment environment. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 6 - 9 - 5.10.4.1 - APO01.06 - APO11.04 - BAI03.05 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.8 - 3.4.1 - CCI-001494 - CCI-001496 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.3.2 - 4.3.4.3.3 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.5.1 - A.12.6.2 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R4.2 - CIP-003-8 R6 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CM-6(d) - CM-6(c) - SI-7 - SI-7(1) - SI-7(6) - AU-9(3) - PR.AC-4 - PR.DS-5 - PR.IP-1 - PR.PT-1 - Req-11.5 - SRG-OS-000256-GPOS-00097 - SRG-OS-000257-GPOS-00098 - SRG-OS-000278-GPOS-00108 - Ownership of binaries and configuration files that is incorrect -could allow an unauthorized user to gain privileges that they should -not have. The ownership set by the vendor should be maintained. Any -deviations from this baseline should be investigated. - CCE-82686-7 - - - - - - - - - Verify and Correct File Permissions with RPM - The RPM package management system can check file access permissions -of installed software packages, including many that are important -to system security. -Verify that the file permissions of system files -and commands match vendor values. Check the file permissions -with the following command: -$ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }' -Output indicates files that do not match vendor defaults. -After locating a file with incorrect permissions, -run the following command to determine which package owns it: -$ rpm -qf FILENAME - -Next, run the following command to reset its permissions to -the correct values: -$ sudo rpm --setperms PACKAGENAME - Profiles may require that specific files have stricter file permissions than defined by the -vendor. -Such files will be reported as a finding and need to be evaluated according to your policy -and deployment environment. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 6 - 9 - 5.10.4.1 - APO01.06 - APO11.04 - BAI03.05 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.8 - 3.4.1 - CCI-001493 - CCI-001494 - CCI-001495 - CCI-001496 - 164.308(a)(1)(ii)(D) - 164.312(b) - 164.312(c)(1) - 164.312(c)(2) - 164.312(e)(2)(i) - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.3.2 - 4.3.4.3.3 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.5.1 - A.12.6.2 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R4.2 - CIP-003-8 R6 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CM-6(d) - CM-6(c) - SI-7 - SI-7(1) - SI-7(6) - AU-9(3) - CM-6(a) - PR.AC-4 - PR.DS-5 - PR.IP-1 - PR.PT-1 - Req-11.5 - SRG-OS-000256-GPOS-00097 - SRG-OS-000257-GPOS-00098 - SRG-OS-000258-GPOS-00099 - SRG-OS-000278-GPOS-00108 - Permissions on system binaries and configuration files that are too generous -could allow an unauthorized user to gain privileges that they should not have. -The permissions set by the vendor should be maintained. Any deviations from -this baseline should be investigated. - CCE-82687-5 - - - - - - - - - - Verify Integrity with AIDE - AIDE conducts integrity checks by comparing information about -files with previously-gathered information. Ideally, the AIDE database is -created immediately after initial system configuration, and then again after any -software update. AIDE is highly configurable, with further configuration -information located in /usr/share/doc/aide-VERSION. - - - Install AIDE - The aide package can be installed with the following command: - - BP28(R51) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 7 - 8 - 9 - 5.10.1.3 - APO01.06 - BAI01.06 - BAI02.01 - BAI03.05 - BAI06.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS03.05 - DSS04.07 - DSS05.02 - DSS05.03 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - CCI-002696 - CCI-002699 - CCI-001744 - 4.3.4.3.2 - 4.3.4.3.3 - 4.3.4.4.4 - SR 3.1 - SR 3.3 - SR 3.4 - SR 3.8 - SR 4.1 - SR 6.2 - SR 7.6 - 1034 - 1288 - 1341 - 1417 - A.11.2.4 - A.12.1.2 - A.12.2.1 - A.12.4.1 - A.12.5.1 - A.12.6.2 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.14.2.7 - A.15.2.1 - A.8.2.3 - CM-6(a) - DE.CM-1 - DE.CM-7 - PR.DS-1 - PR.DS-6 - PR.DS-8 - PR.IP-1 - PR.IP-3 - Req-11.5 - SRG-OS-000363-GPOS-00150 - SRG-OS-000445-GPOS-00199 - The AIDE package must be installed if it is to be available for integrity checking. - - - - - - - - - - Build and Test AIDE Database - Run the following command to generate a new database: - -$ sudo /usr/sbin/aide --init - -By default, the database will be written to the file - -/var/lib/aide/aide.db.new.gz. - -Storing the database, the configuration file /etc/aide.conf, and the binary -/usr/sbin/aide -(or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. -The newly-generated database can be installed as follows: - -$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz - -To initiate a manual check, run the following command: -$ sudo /usr/sbin/aide --check -If this check produces any unexpected output, investigate. - BP28(R51) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 7 - 8 - 9 - 5.10.1.3 - APO01.06 - BAI01.06 - BAI02.01 - BAI03.05 - BAI06.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS03.05 - DSS04.07 - DSS05.02 - DSS05.03 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 4.3.4.3.2 - 4.3.4.3.3 - 4.3.4.4.4 - SR 3.1 - SR 3.3 - SR 3.4 - SR 3.8 - SR 4.1 - SR 6.2 - SR 7.6 - A.11.2.4 - A.12.1.2 - A.12.2.1 - A.12.4.1 - A.12.5.1 - A.12.6.2 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.14.2.7 - A.15.2.1 - A.8.2.3 - CM-6(a) - DE.CM-1 - DE.CM-7 - PR.DS-1 - PR.DS-6 - PR.DS-8 - PR.IP-1 - PR.IP-3 - Req-11.5 - For AIDE to be effective, an initial database of "known-good" information about files -must be captured and it should be able to be verified against the installed files. - - - - - - - - - - - - Federal Information Processing Standard (FIPS) - The Federal Information Processing Standard (FIPS) is a computer security standard which -is developed by the U.S. Government and industry working groups to validate the quality -of cryptographic modules. The FIPS standard provides four security levels to ensure -adequate coverage of different industries, implementation of cryptographic modules, and -organizational sizes and requirements. - -FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules -utilize authentication that meets industry and government requirements. For government systems, this allows -Security Levels 1, 2, 3, or 4 for use on Red Hat Enterprise Linux CoreOS 4. - -See http://csrc.nist.gov/publications/PubsFIPS.html for more information. - - - Install the dracut-fips-aesni Package - To enable FIPS on system that support the Advanced Encryption Standard (AES) or New -Instructions (AES-NI) engine, the system requires that the dracut-fips-aesni -package be installed. -The dracut-fips-aesni package can be installed with the following command: - - The system needs to be rebooted for these changes to take effect. - System Crypto Modules must be provided by a vendor that undergoes -FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use -cryptographic-based security systems to protect sensitive information -in computer and telecommunication systems (including voice systems) as -defined in Section 5131 of the Information Technology Management Reform -Act of 1996, Public Law 104-106. This standard shall be used in -designing and implementing cryptographic modules that Federal -departments and agencies operate or are operated for them under -contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by -a vendor that has undergone this certification. This means providing -documentation, test results, design information, and independent third -party review by an accredited lab. While open source software is -capable of meeting this, it does not meet FIPS-140 unless the vendor -submits to this process. - 12 - 15 - 8 - 5.10.1.2 - APO13.01 - DSS01.04 - DSS05.02 - DSS05.03 - 3.13.11 - 3.13.8 - CCI-000068 - CCI-000803 - CCI-002450 - 4.3.3.6.6 - SR 1.13 - SR 2.6 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.6.2.1 - A.6.2.2 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - PR.AC-3 - PR.PT-4 - SRG-OS-000033-GPOS-00014 - SRG-OS-000396-GPOS-00176 - SRG-OS-000478-GPOS-00223 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The operating system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested -and validated. - - - - - - - - - - Install the dracut-fips Package - To enable FIPS, the system requires that the dracut-fips -package be installed. -The dracut-fips package can be installed with the following command: - - System Crypto Modules must be provided by a vendor that undergoes -FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use -cryptographic-based security systems to protect sensitive information -in computer and telecommunication systems (including voice systems) as -defined in Section 5131 of the Information Technology Management Reform -Act of 1996, Public Law 104-106. This standard shall be used in -designing and implementing cryptographic modules that Federal -departments and agencies operate or are operated for them under -contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by -a vendor that has undergone this certification. This means providing -documentation, test results, design information, and independent third -party review by an accredited lab. While open source software is -capable of meeting this, it does not meet FIPS-140 unless the vendor -submits to this process. - 12 - 15 - 8 - 5.10.1.2 - APO13.01 - DSS01.04 - DSS05.02 - DSS05.03 - 3.13.11 - 3.13.8 - CCI-000068 - CCI-000803 - CCI-002450 - 4.3.3.6.6 - SR 1.13 - SR 2.6 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.6.2.1 - A.6.2.2 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - PR.AC-3 - PR.PT-4 - SRG-OS-000033-GPOS-00014 - SRG-OS-000396-GPOS-00176 - SRG-OS-000478-GPOS-00223 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The operating system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested -and validated. - - - - - - - - - - Enable Dracut FIPS Module - To enable FIPS mode, run the following command: -fips-mode-setup --enable -To enable FIPS, the system requires that the fips module is added in dracut configuration. -Check if /etc/dracut.conf.d/40-fips.conf contain add_dracutmodules+=" fips " - The system needs to be rebooted for these changes to take effect. - System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use cryptographic-based security -systems to protect sensitive information in computer and telecommunication systems -(including voice systems) as defined in Section 5131 of the Information Technology -Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing -and implementing cryptographic modules that Federal departments and agencies operate or are -operated for them under contract. -See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by a vendor that has -undergone this certification. This means providing documentation, test results, design -information, and independent third party review by an accredited lab. While open source -software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to -this process. - CCI-000068 - CCI-000803 - CCI-002450 - 1446 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - FCS_RBG_EXT.1 - SRG-OS-000478-GPOS-00223 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The operating system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested -and validated. - - CCE-82548-9 - - - - - - - - - Enable FIPS Mode - To enable FIPS mode, run the following command: -fips-mode-setup --enable - -The fips-mode-setup command will configure the system in -FIPS mode by automatically configuring the following: -Setting the kernel FIPS mode flag (/proc/sys/crypto/fips_enabled) to 1Creating /etc/system-fipsSetting the system crypto policy in /etc/crypto-policies/config to Loading the Dracut fips module - The system needs to be rebooted for these changes to take effect. - This rule DOES NOT CHECK if the components of the operating system are FIPS certified. -You can find the list of FIPS certified modules at -https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search. -This rule checks if the system is running in FIPS mode. See the rule description for more information about what it means. - CCI-000068 - CCI-000803 - CCI-002450 - 1446 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CM-3(6) - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - FCS_COP.1(1) - FCS_COP.1(2) - FCS_COP.1(3) - FCS_COP.1(4) - FCS_CKM.1 - FCS_CKM.2 - FCS_TLSC_EXT.1 - FCS_RBG_EXT.1 - SRG-OS-000478-GPOS-00223 - SRG-OS-000396-GPOS-00176 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The operating system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested -and validated. - - CCE-82540-6 - - - - - - - - - - Ensure '/etc/system-fips' exists - On a system where FIPS mode is enabled, /etc/system-fips must exist. -To enable FIPS mode, run the following command: -fips-mode-setup --enable - The system needs to be rebooted for these changes to take effect. - System Crypto Modules must be provided by a vendor that undergoes -FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use -cryptographic-based security systems to protect sensitive information -in computer and telecommunication systems (including voice systems) as -defined in Section 5131 of the Information Technology Management Reform -Act of 1996, Public Law 104-106. This standard shall be used in -designing and implementing cryptographic modules that Federal -departments and agencies operate or are operated for them under -contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by -a vendor that has undergone this certification. This means providing -documentation, test results, design information, and independent third -party review by an accredited lab. While open source software is -capable of meeting this, it does not meet FIPS-140 unless the vendor -submits to this process. - CCI-000068 - CCI-000803 - CCI-002450 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The operating system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested -and validated. - - - - - - - - - - Enable FIPS Mode in GRUB2 - To ensure FIPS mode is enabled, install package dracut-fips, and rebuild initramfs by running the following commands: - -dracut -f -After the dracut command has been run, add the argument fips=1 to the default -GRUB 2 command line for the Linux operating system in -/etc/default/grub, in the manner below: -GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 fips=1" -Finally, rebuild the grub.cfg file by using the -grub2-mkconfig -o command as follows: -On BIOS-based machines, issue the following command as root: -~]# grub2-mkconfig -o /boot/grub2/grub.cfgOn UEFI-based machines, issue the following command as root: -~]# grub2-mkconfig -o /boot/grub2/grub.cfg - Running dracut -f will overwrite the existing initramfs file. - The system needs to be rebooted for these changes to take effect. - System Crypto Modules must be provided by a vendor that undergoes -FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use -cryptographic-based security systems to protect sensitive information -in computer and telecommunication systems (including voice systems) as -defined in Section 5131 of the Information Technology Management Reform -Act of 1996, Public Law 104-106. This standard shall be used in -designing and implementing cryptographic modules that Federal -departments and agencies operate or are operated for them under -contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by -a vendor that has undergone this certification. This means providing -documentation, test results, design information, and independent third -party review by an accredited lab. While open source software is -capable of meeting this, it does not meet FIPS-140 unless the vendor -submits to this process. - 12 - 15 - 8 - 5.10.1.2 - APO13.01 - DSS01.04 - DSS05.02 - DSS05.03 - 3.13.8 - 3.13.11 - CCI-000068 - CCI-000803 - CCI-001199 - CCI-002450 - CCI-002476 - 4.3.3.6.6 - SR 1.13 - SR 2.6 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.6.2.1 - A.6.2.2 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - PR.AC-3 - PR.PT-4 - SRG-OS-000033-GPOS-00014 - SRG-OS-000185-GPOS-00079 - SRG-OS-000396-GPOS-00176 - SRG-OS-000405-GPOS-00184 - SRG-OS-000478-GPOS-00223 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The operating system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested -and validated. - - - - - - - - - - Set kernel parameter 'crypto.fips_enabled' to 1 - System running in FIPS mode is indicated by kernel parameter -'crypto.fips_enabled'. This parameter should be set to 1 in FIPS mode. -To enable FIPS mode, run the following command: -fips-mode-setup --enable - The system needs to be rebooted for these changes to take effect. - System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use cryptographic-based security -systems to protect sensitive information in computer and telecommunication systems -(including voice systems) as defined in Section 5131 of the Information Technology -Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing -and implementing cryptographic modules that Federal departments and agencies operate or are -operated for them under contract. -See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by a vendor that has -undergone this certification. This means providing documentation, test results, design -information, and independent third party review by an accredited lab. While open source -software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to -this process. - CCI-000068 - CCI-000803 - CCI-000877 - CCI-001453 - CCI-002418 - CCI-002450 - CCI-002890 - CCI-003123 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - SRG-OS-000033-GPOS-00014 - SRG-OS-000125-GPOS-00065 - SRG-OS-000250-GPOS-00093 - SRG-OS-000393-GPOS-00173 - SRG-OS-000394-GPOS-00174 - SRG-OS-000396-GPOS-00176 - SRG-OS-000423-GPOS-00187 - SRG-OS-000478-GPOS-00223 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to -protect data. The operating system must implement cryptographic modules adhering to the higher -standards approved by the federal government since this provides assurance they have been tested -and validated. - - - - - - - - System Cryptographic Policies - Linux has the capability to centrally configure cryptographic polices. The command -update-crypto-policies is used to set the policy applicable for the various -cryptographic back-ends, such as SSL/TLS libraries. The configured cryptographic -policies will be the default policy used by these backends unless the application -user configures them otherwise. When the system has been configured to use the -centralized cryptographic policies, the administrator is assured that any application -that utilizes the supported backends will follow a policy that adheres to the -configured profile. - -Currently the supported backends are: -GnuTLS libraryOpenSSL libraryNSS libraryOpenJDKLibkrb5BINDOpenSSH -Applications and languages which rely on any of these backends will follow the -system policies as well. Examples are apache httpd, nginx, php, and others. - - SSH client RekeyLimit - size - Specify the size component of the rekey limit. This limit signifies amount -of data. After this amount of data is transferred through the connection, -the session key is renegotiated. The number is followed by K, M or G for -kilobytes, megabytes or gigabytes. Note that the RekeyLimit can be also -configured according to elapsed time. - 512M - 512M - 1G - - - SSH client RekeyLimit - time - Specify the time component of the rekey limit. The session key is -renegotiated after the defined amount of time passes. The number is followed -by units such as H or M for hours or minutes. Note that the RekeyLimit can -be also configured according to amount of transfered data. - 1h - 1h - - - The system-provided crypto policies - Specify the crypto policy for the system. - DEFAULT - DEFAULT - DEFAULT:NO-SHA1 - FIPS - FIPS:OSPP - LEGACY - FUTURE - NEXT - - - Configure BIND to use System Crypto Policy - Crypto Policies provide a centralized control over crypto algorithms usage of many packages. -BIND is supported by crypto policy, but the BIND configuration may be -set up to ignore it. - -To check that Crypto Policies settings are configured correctly, ensure that the /etc/named.conf -includes the appropriate configuration: -In the options section of /etc/named.conf, make sure that the following line -is not commented out or superseded by later includes: -include "/etc/crypto-policies/back-ends/bind.config"; - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-13 - SC-12(2) - SC-12(3) - SRG-OS-000423-GPOS-00187 - SRG-OS-000426-GPOS-00190 - Overriding the system crypto policy makes the behavior of the BIND service violate expectations, -and makes system configuration more fragmented. - CCE-82544-8 - - - - - - - - - Configure System Cryptography Policy - To configure the system cryptography policy to use ciphers only from the -policy, create a MachineConfig as follows: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 50-master-configure-crypto-policy -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: configure-crypto-policy.service - enabled: true - contents: | - [Unit] - Before=kubelet.service - [Service] - Type=oneshot - ExecStart=update-crypto-policies --set - RemainAfterExit=yes - [Install] - WantedBy=multi-user.target - - -This will configure the crypto policy appropriately in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - -The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the /etc/crypto-policies/back-ends are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied. -Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon. - The system needs to be rebooted for these changes to take effect. - System Crypto Modules must be provided by a vendor that undergoes -FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use -cryptographic-based security systems to protect sensitive information -in computer and telecommunication systems (including voice systems) as -defined in Section 5131 of the Information Technology Management Reform -Act of 1996, Public Law 104-106. This standard shall be used in -designing and implementing cryptographic modules that Federal -departments and agencies operate or are operated for them under -contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by -a vendor that has undergone this certification. This means providing -documentation, test results, design information, and independent third -party review by an accredited lab. While open source software is -capable of meeting this, it does not meet FIPS-140 unless the vendor -submits to this process. - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.312(e)(1) - 164.312(e)(2)(ii) - 1446 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CIP-007-3 R7.1 - AC-17(a) - AC-17(2) - CM-6(a) - MA-4(6) - SC-13 - SC-12(2) - SC-12(3) - FCS_COP.1(1) - FCS_COP.1(2) - FCS_COP.1(3) - FCS_COP.1(4) - FCS_CKM.1 - FCS_CKM.2 - FCS_TLSC_EXT.1 - SRG-OS-000396-GPOS-00176 - SRG-OS-000393-GPOS-00173 - SRG-OS-000394-GPOS-00174 - Centralized cryptographic policies simplify applying secure ciphers across an operating system and -the applications that run on that operating system. Use of weak or untested encryption algorithms -undermines the purposes of utilizing encryption to protect data. - CCE-82541-4 - - - - - - - - - - Configure Kerberos to use System Crypto Policy - Crypto Policies provide a centralized control over crypto algorithms usage of many packages. -Kerberos is supported by crypto policy, but it's configuration may be -set up to ignore it. -To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at -/etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config. -If the symlink exists, Kerberos is configured to use the system-wide crypto policy settings. - 0418 - 1055 - 1402 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-13 - SC-12(2) - SC-12(3) - SRG-OS-000120-GPOS-00061 - Overriding the system crypto policy makes the behavior of Kerberos violate expectations, -and makes system configuration more fragmented. - CCE-82547-1 - - - - - - - - - Configure Libreswan to use System Crypto Policy - Crypto Policies provide a centralized control over crypto algorithms usage of many packages. -Libreswan is supported by system crypto policy, but the Libreswan configuration may be -set up to ignore it. - -To check that Crypto Policies settings are configured correctly, ensure that the /etc/ipsec.conf -includes the appropriate configuration file. -In /etc/ipsec.conf, make sure that the following line -is not commented out or superseded by later includes: -include /etc/crypto-policies/back-ends/libreswan.config - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CM-6(a) - MA-4(6) - SC-13 - SC-12(2) - SC-12(3) - FCS_IPSEC_EXT.1.4 - FCS_IPSEC_EXT.1.6 - SRG-OS-000033-GPOS-00014 - Overriding the system crypto policy makes the behavior of the Libreswan -service violate expectations, and makes system configuration more -fragmented. - CCE-82546-3 - - - - - - - - - Configure OpenSSL library to use System Crypto Policy - Crypto Policies provide a centralized control over crypto algorithms usage of many packages. -OpenSSL is supported by crypto policy, but the OpenSSL configuration may be -set up to ignore it. -To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file -available under /etc/pki/tls/openssl.cnf. -This file has the ini format, and it enables crypto policy support -if there is a [ crypto_policy ] section that contains the .include /etc/crypto-policies/back-ends/opensslcnf.config directive. - CCI-001453 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CIP-007-3 R7.1 - AC-17(a) - AC-17(2) - CM-6(a) - MA-4(6) - SC-13 - SC-12(2) - SC-12(3) - SRG-OS-000250-GPOS-00093 - Overriding the system crypto policy makes the behavior of the Java runtime violates expectations, -and makes system configuration more fragmented. - CCE-82545-5 - - - - - - - - - Configure SSH to use System Crypto Policy - Crypto Policies provide a centralized control over crypto algorithms usage of many packages. -SSH is supported by crypto policy, but the SSH configuration may be -set up to ignore it. -To check that Crypto Policies settings are configured correctly, ensure that -the CRYPTO_POLICY variable is either commented or not set at all -in the /etc/sysconfig/sshd. - CCI-001453 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.312(e)(1) - 164.312(e)(2)(ii) - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CIP-007-3 R7.1 - AC-17(a) - AC-17(2) - CM-6(a) - MA-4(6) - SC-13 - FCS_SSH_EXT.1 - FCS_SSHS_EXT.1 - FCS_SSHC_EXT.1 - SRG-OS-000250-GPOS-00093 - Overriding the system crypto policy makes the behavior of the SSH service violate expectations, -and makes system configuration more fragmented. - - - - - - - - - Harden OpenSSL Crypto Policy - Crypto Policies are means of enforcing certain cryptographic settings for -selected applications including OpenSSL. OpenSSL is by default configured to -modify its configuration based on currently configured Crypto Policy. -However, in certain cases it might be needed to override the Crypto Policy -specific to OpenSSL and leave rest of the Crypto Policy intact. This can -be done by dropping a file named opensslcnf-xxx.config, replacing -xxx with arbitrary identifier, into -/etc/crypto-policies/local.d. This has to be followed by running -update-crypto-policies so that changes are applied. Changes are -propagated into /etc/crypto-policies/back-ends/opensslcnf.config. -This rule checks if this file contains predefined Ciphersuites -variable configured with predefined value. - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-8(1) - SC-13 - FCS_TLSC_EXT.1.1 - SRG-OS-000396-GPOS-00176 - SRG-OS-000424-GPOS-00188 - SRG-OS-000478-GPOS-00223 - The Common Criteria requirements specify that certain parameters for OpenSSL -are configured e.g. cipher suites. Currently particular requirements -specified by CC are stricter compared to any existing Crypto Policy. - CCE-84285-6 - - - - - - - - - Harden SSH client Crypto Policy - Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH client. -To override the system wide crypto policy for Openssh client, place a file in the /etc/ssh/ssh_config.d/ so that it is loaded before the 05-redhat.conf. In this case it is file named 02-ospp.conf containing parameters which need to be changed with respect to the crypto policy. -This rule checks if the file exists and if it contains required parameters and values which modify the Crypto Policy. -During the parsing process, as soon as Openssh client parses some configuration option and its value, it remembers it and ignores any subsequent overrides. The customization mechanism provided by crypto policies appends eventual customizations at the end of the system wide crypto policy. Therefore, if the crypto policy customization overrides some parameter which is already configured in the system wide crypto policy, the SSH client will not honor that customized parameter. - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CIP-007-3 R7.1 - AC-17(a) - AC-17(2) - CM-6(a) - MA-4(6) - SC-13 - FCS_SSHC_EXT.1 - SRG-OS-000033-GPOS-00014 - SRG-OS-000250-GPOS-00093 - SRG-OS-000393-GPOS-00173 - SRG-OS-000394-GPOS-00174 - The Common Criteria requirements specify how certain parameters for OpenSSH Client are configured. Particular parameters are RekeyLimit, GSSAPIAuthentication, Ciphers, PubkeyAcceptedKeyTypes, MACs and KexAlgorithms. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy. - CCE-82543-0 - - - - - - - - - Harden SSHD Crypto Policy - Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH server. -The SSHD service is by default configured to modify its configuration based on currently configured Crypto-Policy. However, in certain cases it might be needed to override the Crypto Policy specific to OpenSSH Server and leave rest of the Crypto Policy intact. -This can be done by dropping a file named opensshserver-xxx.config, replacing xxx with arbitrary identifier, into /etc/crypto-policies/local.d. This has to be followed by running update-crypto-policies so that changes are applied. -Changes are propagated into /etc/crypto-policies/back-ends/opensshserver.config. This rule checks if this file contains predefined CRYPTO_POLICY environment variable configured with predefined value. - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CIP-007-3 R7.1 - AC-17(a) - AC-17(2) - CM-6(a) - MA-4(6) - SC-13 - SC-12(2) - SC-12(3) - FCS_SSHS_EXT.1 - SRG-OS-000250-GPOS-00093 - SRG-OS-000033-GPOS-00014 - SRG-OS-000120-GPOS-00061 - The Common Criteria requirements specify that certain parameters for OpenSSH Server are configured e.g. supported ciphers, accepted host key algorithms, public key types, key exchange algorithms, HMACs and GSSAPI key exchange is disabled. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy. - CCE-82542-2 - - - - - - - - - - - Operating System Vendor Support and Certification - The assurance of a vendor to provide operating system support and maintenance -for their product is an important criterion to ensure product stability and -security over the life of the product. A certified product that follows the -necessary standards and government certification requirements guarantees that -known software vulnerabilities will be remediated, and proper guidance for -protecting and securing the operating system will be given. - - The Installed Operating System Is FIPS 140-2 Certified - To enable processing of sensitive information the operating system must -provide certified cryptographic modules compliant with FIPS 140-2 -standard. - There is no remediation besides switching to a different operating system. - System Crypto Modules must be provided by a vendor that undergoes -FIPS-140 certifications. -FIPS-140 is applicable to all Federal agencies that use -cryptographic-based security systems to protect sensitive information -in computer and telecommunication systems (including voice systems) as -defined in Section 5131 of the Information Technology Management Reform -Act of 1996, Public Law 104-106. This standard shall be used in -designing and implementing cryptographic modules that Federal -departments and agencies operate or are operated for them under -contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf -To meet this, the system has to have cryptographic software provided by -a vendor that has undergone this certification. This means providing -documentation, test results, design information, and independent third -party review by an accredited lab. While open source software is -capable of meeting this, it does not meet FIPS-140 unless the vendor -submits to this process. - CCI-000803 - CCI-002450 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - SC-12(2) - SC-12(3) - IA-7 - SC-13 - CM-6(a) - SC-12 - SRG-OS-000120-VMM-000600 - SRG-OS-000478-VMM-001980 - SRG-OS-000396-VMM-001590 - The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS -PUB 140-2) is a computer security standard. The standard specifies security -requirements for cryptographic modules used to protect sensitive -unclassified information. Refer to the full FIPS 140-2 standard at - - http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf -for further details on the requirements. -FIPS 140-2 validation is required by U.S. law when information systems use -cryptography to protect sensitive government information. In order to -achieve FIPS 140-2 certification, cryptographic modules are subject to -extensive testing by independent laboratories, accredited by National -Institute of Standards and Technology (NIST). - - - - - - - - - - Endpoint Protection Software - Endpoint protection security software that is not provided or supported - -by Red Hat can be installed to provide complementary or duplicative - -security capabilities to those provided by the base platform. Add-on -software may not be appropriate for some specialized systems. - - Configure Backups of User Data - The operating system must conduct backups of user data contained -in the operating system. The operating system provides utilities for -automating backups of user data. Commercial and open-source products -are also available. - Operating system backup is a critical step in maintaining data assurance and -availability. User-level information is data generated by information system -and/or application users. Backups shall be consistent with organizational -recovery time and recovery point objectives. - - - - - - McAfee Endpoint Security Software - In DoD environments, McAfee Host-based Security System (HBSS) and -VirusScan Enterprise for Linux (VSEL) is required to be installed on all systems. - - The age of McAfee defintion file before requiring updating - Specify the amount of time (in seconds) before McAfee definition files need to be -updated. - 2592000 - 86400 - 604800 - 2592000 - - - McAfee Endpoint Security for Linux (ENSL) - McAfee Endpoint Security for Linux (ENSL) is a suite of software applications -used to monitor, detect, and defend computer networks and systems. - - - - McAfee Host-Based Intrusion Detection Software (HBSS) - McAfee Host-based Security System (HBSS) is a suite of software applications -used to monitor, detect, and defend computer networks and systems. - - Install the Host Intrusion Prevention System (HIPS) Module - Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is absolutely -necessary. If SELinux is enabled, do not install or enable this module. - Installing and enabling this module conflicts with SELinux. -Per DoD/DISA guidance, SELinux takes precedence over this module. - Due to McAfee HIPS being 3rd party software, automated -remediation is not available for this configuration check. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO01.06 - APO07.06 - APO08.04 - APO10.05 - APO11.06 - APO12.01 - APO12.02 - APO12.03 - APO12.04 - APO12.06 - APO13.01 - APO13.02 - BAI08.02 - BAI08.04 - DSS01.03 - DSS01.05 - DSS02.04 - DSS02.05 - DSS02.07 - DSS03.01 - DSS03.04 - DSS03.05 - DSS04.05 - DSS05.01 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.01 - DSS06.02 - MEA03.03 - MEA03.04 - CCI-000366 - CCI-001233 - CCI-001263 - 4.2.3 - 4.2.3.12 - 4.2.3.7 - 4.2.3.9 - 4.3.3.4 - 4.3.4.5.2 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.3.4.5.9 - 4.4.3.2 - 4.4.3.3 - 4.4.3.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.4 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.3 - SR 3.5 - SR 3.8 - SR 3.9 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.4.1 - A.12.4.3 - A.12.5.1 - A.12.6.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.7 - A.14.2.8 - A.15.2.1 - A.16.1.1 - A.16.1.2 - A.16.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.6 - A.16.1.7 - A.18.1.4 - A.18.2.2 - A.18.2.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - Clause 16.1.2 - Clause 7.4 - CM-6(a) - DE.AE-1 - DE.AE-2 - DE.AE-3 - DE.AE-4 - DE.CM-1 - DE.CM-5 - DE.CM-6 - DE.CM-7 - DE.DP-2 - DE.DP-3 - DE.DP-4 - DE.DP-5 - ID.RA-1 - PR.AC-5 - PR.DS-5 - PR.IP-8 - PR.PT-4 - RS.AN-1 - RS.CO-3 - Req-11.4 - SRG-OS-000191-GPOS-00080 - SRG-OS-000196 - SRG-OS-000480-GPOS-00227 - Without a host-based intrusion detection tool, there is no system-level defense -when an intruder gains access to a system or network. Additionally, a host-based -intrusion prevention tool can provide methods to immediately lock out detected -intrusion attempts. - - - - - - - - - - - - - - Disk Partitioning - To ensure separation and protection of data, there -are top-level system directories which should be placed on their -own physical partition or logical volume. The installer's default -partitioning scheme creates separate logical volumes for -/, /boot, and swap. -If starting with any of the default layouts, check the box to -\"Review and modify partitioning.\" This allows for the easy creation -of additional logical volumes inside the volume group already -created, though it may require making /'s logical volume smaller to -create space. In general, using logical volumes is preferable to -using partitions because they can be more easily adjusted -later.If creating a custom layout, create the partitions mentioned in -the previous paragraph (which the installer will require anyway), -as well as separate ones described in the following sections. -If a system has already been installed, and the default -partitioning -scheme was used, it is possible but nontrivial to -modify it to create separate logical volumes for the directories -listed above. The Logical Volume Manager (LVM) makes this possible. -See the LVM HOWTO at - http://tldp.org/HOWTO/LVM-HOWTO/ -for more detailed information on LVM. - - Encrypt Partitions - Red Hat Enterprise Linux CoreOS 4 natively supports partition encryption through the -Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to -encrypt a partition is during installation time. - -For manual installations, select the Encrypt checkbox during -partition creation to encrypt the partition. When this -option is selected the system will prompt for a passphrase to use in -decrypting the partition. The passphrase will subsequently need to be entered manually -every time the system boots. - - -For automated/unattended installations, it is possible to use Kickstart by adding -the --encrypted and --passphrase= options to the definition of each partition to be -encrypted. For example, the following line would encrypt the root partition: -part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE -Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart -must then be protected accordingly. -Omitting the --passphrase= option from the partition definition will cause the -installer to pause and interactively ask for the passphrase during installation. - -By default, the Anaconda installer uses aes-xts-plain64 cipher -with a minimum 512 bit key size which should be compatible with FIPS enabled. - - -Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on -the Red Hat Enterprise Linux CoreOS 4 Documentation web site: - - - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening -. - 13 - 14 - APO01.06 - BAI02.01 - BAI06.01 - DSS04.07 - DSS05.03 - DSS05.04 - DSS05.07 - DSS06.02 - DSS06.06 - 3.13.16 - CCI-001199 - CCI-002475 - CCI-002476 - 164.308(a)(1)(ii)(D) - 164.308(b)(1) - 164.310(d) - 164.312(a)(1) - 164.312(a)(2)(iii) - 164.312(a)(2)(iv) - 164.312(b) - 164.312(c) - 164.314(b)(2)(i) - 164.312(d) - SR 3.4 - SR 4.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CM-6(a) - SC-28 - SC-28(1) - SC-13 - AU-9(3) - PR.DS-1 - PR.DS-5 - SRG-OS-000405-GPOS-00184 - SRG-OS-000185-GPOS-00079 - SRG-OS-000404-GPOS-00183 - SRG-OS-000404-VMM-001650 - SRG-OS-000405-VMM-001660 - The risk of a system's physical compromise, particularly mobile systems such as -laptops, places its data at risk of compromise. Encrypting this data mitigates -the risk of its loss if the system is lost. - - - - - - - Ensure /home Located On Separate Partition - If user home directories will be stored locally, create a separate partition -for /home at installation time (or migrate it later using LVM). If -/home will be mounted from another system such as an NFS server, then -creating a separate partition is not necessary at installation time, and the -mountpoint can instead be configured later. - BP28(R12) - 12 - 15 - 8 - APO13.01 - DSS05.02 - CCI-000366 - CCI-001208 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - CM-6(a) - SC-5(2) - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Ensuring that /home is mounted on its own partition enables the -setting of more restrictive mount options, and also helps ensure that -users cannot trivially fill partitions used for log or audit data storage. - - CCE-82739-4 - - - - - - - - - Ensure /srv Located On Separate Partition - If a file server (FTP, TFTP...) is hosted locally, create a separate partition -for /srv at installation time (or migrate it later using LVM). If -/srv will be mounted from another system such as an NFS server, then -creating a separate partition is not necessary at installation time, and the -mountpoint can instead be configured later. - BP28(R12) - Srv deserves files for local network file server such as FTP. Ensuring -that /srv is mounted on its own partition enables the setting of -more restrictive mount options, and also helps ensure that -users cannot trivially fill partitions used for log or audit data storage. - - - - - - - - - - Ensure /tmp Located On Separate Partition - The /tmp directory is a world-writable directory used -for temporary file storage. Ensure it has its own partition or -logical volume at installation time, or migrate it using LVM. - BP28(R12) - 12 - 15 - 8 - APO13.01 - DSS05.02 - CCI-000366 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - CM-6(a) - SC-5(2) - PR.PT-4 - SRG-OS-000480-GPOS-00227 - The /tmp partition is used as temporary storage by many programs. -Placing /tmp in its own partition enables the setting of more -restrictive mount options, which can help protect programs which use it. - - - - - - - - - - Ensure /var Located On Separate Partition - The /var directory is used by daemons and other system -services to store frequently-changing data. Ensure that /var has its own partition -or logical volume at installation time, or migrate it using LVM. - BP28(R12) - 12 - 15 - 8 - APO13.01 - DSS05.02 - CCI-000366 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - CM-6(a) - SC-5(2) - PR.PT-4 - SRG-OS-000480-GPOS-00227 - SRG-OS-000341-VMM-001220 - Ensuring that /var is mounted on its own partition enables the -setting of more restrictive mount options. This helps protect -system services such as daemons or other programs which use it. -It is not uncommon for the /var directory to contain -world-writable directories installed by other software packages. - - - - - - - - - - Ensure /var/log Located On Separate Partition - System logs are stored in the /var/log directory. - -Partitioning Red Hat CoreOS is a Day 1 operation and cannot -be changed afterwards. For documentation on how to add a -MachineConfig manifest that specifies a separate /var/log -partition, follow: - - https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic - - -Note that the Red Hat OpenShift documentation often references a block -device, such as /dev/vda. The name of the available block devices depends -on the underlying infrastructure (bare metal vs cloud), and often the specific -instance type. For example in AWS, some instance types have NVMe drives -(/dev/nvme*), others use /dev/xvda*. - -You will need to look for relevant documentation for your infrastructure around this. -In many cases, the simplest thing is to boot a single machine with an Ignition -configuration that just gives you SSH access, and inspect the block devices via -e.g. the lsblk command. - -For physical hardware, a good best practice is to reference devices via the -/dev/disk/by-id/ or /dev/disk/by-path links. - - BP28(R12) - BP28(R47) - 1 - 12 - 14 - 15 - 16 - 3 - 5 - 6 - 8 - APO11.04 - APO13.01 - BAI03.05 - DSS05.02 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000366 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - CIP-007-3 R6.5 - CM-6(a) - AU-4 - SC-5(2) - PR.PT-1 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Placing /var/log in its own partition -enables better separation between log files -and other files in /var/. - - CCE-82737-8 - - - - - - Ensure /var/log/audit Located On Separate Partition - Audit logs are stored in the /var/log/audit directory. - -Partitioning Red Hat CoreOS is a Day 1 operation and cannot -be changed afterwards. For documentation on how to add a -MachineConfig manifest that specifies a separate /var/log/audit -partition, follow: - - https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic - - -Note that the Red Hat OpenShift documentation often references a block -device, such as /dev/vda. The name of the available block devices depends -on the underlying infrastructure (bare metal vs cloud), and often the specific -instance type. For example in AWS, some instance types have NVMe drives -(/dev/nvme*), others use /dev/xvda*. - -You will need to look for relevant documentation for your infrastructure around this. -In many cases, the simplest thing is to boot a single machine with an Ignition -configuration that just gives you SSH access, and inspect the block devices via -e.g. the lsblk command. - -For physical hardware, a good best practice is to reference devices via the -/dev/disk/by-id/ or /dev/disk/by-path links. - - -Make absolutely certain that it is large enough to store all -audit logs that will be created by the auditing daemon. - BP28(R43) - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 8 - APO11.04 - APO13.01 - BAI03.05 - BAI04.04 - DSS05.02 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000366 - CCI-001849 - 164.312(a)(2)(ii) - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.2 - SR 7.6 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.17.2.1 - CIP-007-3 R6.5 - CM-6(a) - AU-4 - SC-5(2) - PR.DS-4 - PR.PT-1 - PR.PT-4 - FMT_SMF_EXT.1 - SRG-OS-000341-GPOS-00132 - SRG-OS-000480-GPOS-00227 - SRG-OS-000341-VMM-001220 - Placing /var/log/audit in its own partition -enables better separation between audit files -and other files, and helps ensure that -auditing cannot be halted due to the partition running out -of space. - - CCE-82738-6 - - - - - - Ensure /var/tmp Located On Separate Partition - The /var/tmp directory is a world-writable directory used -for temporary file storage. Ensure it has its own partition or -logical volume at installation time, or migrate it using LVM. - BP28(R12) - SRG-OS-000480-GPOS-00227 - The /var/tmp partition is used as temporary storage by many programs. -Placing /var/tmp in its own partition enables the setting of more -restrictive mount options, which can help protect programs which use it. - - CCE-82734-5 - - - - - - - - - - GNOME Desktop Environment - GNOME is a graphical desktop environment bundled with many Linux distributions that -allow users to easily interact with the operating system graphically rather than -textually. The GNOME Graphical Display Manager (GDM) provides login, logout, and user -switching contexts as well as display server management. - -GNOME is developed by the GNOME Project and is considered the default - -Red Hat Graphical environment. - - -For more information on GNOME and the GNOME Project, see https://www.gnome.org. - - - Configure GNOME Login Screen - In the default GNOME desktop, the login is displayed after system boot -and can display user accounts, allow users to reboot the system, and allow users to -login automatically and/or with a guest account. The login screen should be configured -to prevent such behavior. - - -For more information about enforcing preferences in the GNOME3 environment using the DConf -configuration system, see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide/> and the man page dconf(1). - - - Disable XDMCP in GDM - XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g. -XDMCP Gnome docs. - -To disable XDMCP support in Gnome, set Enable to false under the [xdmcp] configuration section in /etc/gdm/custom.conf. For example: - -[xdmcp] -Enable=false - - XDMCP provides unencrypted remote access through the Gnome Display Manager (GDM) which does -not provide for the confidentiality and integrity of user passwords or the -remote session. If a privileged user were to login using XDMCP, the -privileged user password could be compromised due to typed XEvents -and keystrokes will traversing over the network in clear text. - - - - - - - - - - - GNOME Media Settings - GNOME media settings that apply to the graphical interface. - - - - GNOME Network Settings - GNOME network settings that apply to the graphical interface. - - - - GNOME Remote Access Settings - GNOME remote access settings that apply to the graphical interface. - - - - Configure GNOME Screen Locking - In the default GNOME3 desktop, the screen can be locked -by selecting the user name in the far right corner of the main panel and -selecting Lock. - -The following sections detail commands to enforce idle activation of the screensaver, -screen locking, a blank-screen screensaver, and an idle activation time. - -Because users should be trained to lock the screen when they -step away from the computer, the automatic locking feature is only -meant as a backup. - -The root account can be screen-locked; however, the root account should -never be used to log into an X Windows environment and should only -be used to for direct login via console in emergency circumstances. - -For more information about enforcing preferences in the GNOME3 environment using the DConf -configuration system, see http://wiki.gnome.org/dconf and -the man page dconf(1). - - - Screensaver Inactivity timeout - Choose allowed duration (in seconds) of inactive graphical sessions - 600 - 900 - 1800 - 300 - 900 - - - Screensaver Lock Delay - Choose allowed duration (in seconds) after a screensaver becomes active before displaying an authentication prompt - 10 - 5 - 0 - 0 - - - - GNOME System Settings - GNOME provides configuration and functionality to a graphical desktop environment -that changes grahical configurations or allow a user to perform -actions that users normally would not be able to do in non-graphical mode such as -remote access configuration, power policies, Geo-location, etc. -Configuring such settings in GNOME will prevent accidential graphical configuration -changes by users from taking place. - - - - - SAP Specific Requirement - SAP (Systems, Applications and Products in Data Processing) is enterprise -software to manage business operations and customer relations. The -following section contains SAP specific requirement that is not part -of standard or common OS setting. - - - Sudo - Sudo, which stands for "su 'do'", provides the ability to delegate authority -to certain users, groups of users, or system administrators. When configured for system -users and/or groups, Sudo can allow a user or group to execute privileged commands -that normally only root is allowed to execute. - -For more information on Sudo and addition Sudo configuration options, see -https://www.sudo.ws. - - Group name dedicated to the use of sudo - Specify the name of the group that should own /usr/bin/sudo. - root - sudogrp - - - Sudo - logfile value - Specify the sudo logfile to use. The default value used here matches the example -location from CIS, which uses /var/log/sudo.log. - /var/log/sudo.log - /var/log/sudo.log - - - Sudo - passwd_timeout value - Defines the number of minutes before the sudo password prompt times out. -Defining 0 means no timeout. The default timeout value is 5 minutes. - 5 - 0 - 1 - 2 - 3 - 5 - - - Sudo - timestamp_timeout value - Defines the number of minutes that can elapse before sudo will ask for a passwd again. -If set to a value less than 0 the user's time stamp will never expire. Defining 0 means always prompt for a -password. The default timeout value is 5 minutes. - 5 - 0 - 1 - 2 - 3 - 5 - 15 - - - Sudo - umask value - Specify the sudo umask to use. The actual umask value that is used is the union -of the user's umask and the sudo umask. -The default sudo umask is 0022. This guarantess sudo never lowers the umask when -running a command. - 0022 - 0022 - 0027 - - - Install sudo Package - The sudo package can be installed with the following command: - - BP28(R19) - 1382 - 1384 - 1386 - CM-6(a) - FMT_MOF_EXT.1 - SRG-OS-000324-GPOS-00125 - sudo is a program designed to allow a system administrator to give -limited root privileges to users and log root activity. The basic philosophy -is to give as few privileges as possible but still allow system users to -get their work done. - - CCE-82523-2 - - - - - - - - - Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC - The sudo NOEXEC tag, when specified, prevents user executed -commands from executing other commands, like a shell for example. -This should be enabled by making sure that the NOEXEC tag exists in -/etc/sudoers configuration file or any sudo configuration snippets -in /etc/sudoers.d/. - BP28(R58) - Restricting the capability of sudo allowed commands to execute sub-commands -prevents users from running programs with privileges they wouldn't have otherwise. - - - - - - - - - Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty - The sudo requiretty tag, when specified, will only execute sudo -commands from users logged in to a real tty. -This should be enabled by making sure that the requiretty tag exists in -/etc/sudoers configuration file or any sudo configuration snippets -in /etc/sudoers.d/. - BP28(R58) - Restricting the use cases in which a user is allowed to execute sudo commands -reduces the attack surface. - - - - - - - - - Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty - The sudo use_pty tag, when specified, will only execute sudo -commands from users logged in to a real tty. -This should be enabled by making sure that the use_pty tag exists in -/etc/sudoers configuration file or any sudo configuration snippets -in /etc/sudoers.d/. - BP28(R58) - Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining -access to the user's terminal after the main program has finished executing. - - - - - - - - - Ensure Sudo Logfile Exists - sudo logfile - A custom log sudo file can be configured with the 'logfile' tag. This rule configures -a sudo custom logfile at the default location suggested by CIS, which uses -/var/log/sudo.log. - A sudo log file simplifies auditing of sudo commands. - - - - - - - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate - The sudo !authenticate option, when specified, allows a user to execute commands using -sudo without having to authenticate. This should be disabled by making sure that the -!authenticate option does not exist in /etc/sudoers configuration file or -any sudo configuration snippets in /etc/sudoers.d/. - BP28(R5) - BP28(R59) - 1 - 12 - 15 - 16 - 5 - DSS05.04 - DSS05.10 - DSS06.03 - DSS06.10 - CCI-002038 - 4.3.3.5.1 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - IA-11 - CM-6(a) - PR.AC-1 - PR.AC-7 - SRG-OS-000373-GPOS-00156 - SRG-OS-000373-GPOS-00157 - SRG-OS-000373-GPOS-00158 - SRG-OS-000373-VMM-001470 - SRG-OS-000373-VMM-001480 - SRG-OS-000373-VMM-001490 - Without re-authentication, users may access resources or perform tasks for which they -do not have authorization. - -When operating systems provide the capability to escalate a functional capability, it -is critical that the user re-authenticate. - - - - - - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD - The sudo NOPASSWD tag, when specified, allows a user to execute -commands using sudo without having to authenticate. This should be disabled -by making sure that the NOPASSWD tag does not exist in -/etc/sudoers configuration file or any sudo configuration snippets -in /etc/sudoers.d/. - BP28(R5) - BP28(R59) - 1 - 12 - 15 - 16 - 5 - DSS05.04 - DSS05.10 - DSS06.03 - DSS06.10 - CCI-002038 - 4.3.3.5.1 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - IA-11 - CM-6(a) - PR.AC-1 - PR.AC-7 - SRG-OS-000373-GPOS-00156 - SRG-OS-000373-GPOS-00157 - SRG-OS-000373-GPOS-00158 - SRG-OS-000373-VMM-001470 - SRG-OS-000373-VMM-001480 - SRG-OS-000373-VMM-001490 - Without re-authentication, users may access resources or perform tasks for which they -do not have authorization. - -When operating systems provide the capability to escalate a functional capability, it -is critical that the user re-authenticate. - - - - - - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo - The sudo NOPASSWD and !authenticate option, when -specified, allows a user to execute commands using sudo without having to -authenticate. This should be disabled by making sure that -NOPASSWD and/or !authenticate do not exist in -/etc/sudoers configuration file or any sudo configuration snippets -in /etc/sudoers.d/." - 1 - 12 - 15 - 16 - 5 - DSS05.04 - DSS05.10 - DSS06.03 - DSS06.10 - CCI-002038 - 4.3.3.5.1 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - IA-11 - CM-6(a) - PR.AC-1 - PR.AC-7 - SRG-OS-000373-GPOS-00156 - Without re-authentication, users may access resources or perform tasks for which they -do not have authorization. - -When operating systems provide the capability to escalate a functional capability, it -is critical that the user re-authenticate. - - - - - - - - - Only the VDSM User Can Use sudo NOPASSWD - The sudo NOPASSWD tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the vdsm user should have this capability in any sudo configuration snippets in /etc/sudoers.d/. - Without re-authentication, users may access resources or perform tasks for which they -do not have authorization. - -When operating systems provide the capability to escalate a functional capability, it -is critical that the user re-authenticate. - - - - - - - - - Explicit arguments in sudo specifications - All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user. -If the command is supposed to be executed only without arguments, pass "" as an argument in the corresponding user specification. - This rule doesn't come with a remediation, as absence of arguments in the user spec doesn't mean that the command is intended to be executed with no arguments. - The rule can produce false findings when an argument contains a comma - sudoers syntax allows comma escaping using backslash, but the check doesn't support that. For example, root ALL=(ALL) echo 1\,2 allows root to execute echo 1,2, but the check would interpret it as two commands echo 1\ and 2. - BP28(R63) - Any argument can modify quite significantly the behavior of a program, whether regarding the -realized operation (read, write, delete, etc.) or accessed resources (path in a file system tree). To -avoid any possibility of misuse of a command by a user, the ambiguities must be removed at the -level of its specification. - -For example, on some systems, the kernel messages are only accessible by root. -If a user nevertheless must have the privileges to read them, the argument of the dmesg command has to be restricted -in order to prevent the user from flushing the buffer through the -c option: - -user ALL = dmesg "" - - - - - - - - - - - Don't define allowed commands in sudoers by means of exclusion - Policies applied by sudo through the sudoers file should not involve negation. - -Each user specification in the sudoers file contains a comma-delimited list of command specifications. -The definition can make use glob patterns, as well as of negations. -Indirect definition of those commands by means of exclusion of a set of commands is trivial to bypass, so it is not allowed to use such constructs. - This rule doesn't come with a remediation, as negations indicate design issues with the sudoers user specifications design. Just removing negations doesn't increase the security - you typically have to rethink the definition of allowed commands to fix the issue. - BP28(R61) - Specifying access right using negation is inefficient and can be easily circumvented. -For example, it is expected that a specification like -# To avoid absolutely , this rule can be easily circumvented! -user ALL = ALL ,!/ bin/sh - prevents the execution of the shell -but that’s not the case: just copy the binary /bin/sh to a different name to make it executable -again through the rule keyword ALL. - - - - - - - - - - Don't target root user in the sudoers file - The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). - -User specifications have to explicitly list the runas spec (i.e. the list of target users that can be impersonated), and ALL or root should not be used. - This rule doesn't come with a remediation, as the exact requirement allows exceptions, and removing lines from the sudoers file can make the system non-administrable. - BP28(R60) - It is common that the command to be executed does not require superuser rights (editing a file -whose the owner is not root, sending a signal to an unprivileged process,etc.). In order to limit -any attempt of privilege escalation through a command, it is better to apply normal user rights. - - - - - - - - - - - System Tooling / Utilities - The following checks evaluate the system for recommended base packages -- both for installation -and removal. - - Ensure gnutls-utils is installed - The gnutls-utils package can be installed with the following command: - - FIA_X509_EXT.1 - FIA_X509_EXT.2 - SRG-OS-000480-GPOS-00227 - GnuTLS is a secure communications library implementing the SSL, TLS and DTLS -protocols and technologies around them. It provides a simple C language -application programming interface (API) to access the secure communications -protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and -other required structures. -This package contains command line TLS client and server and certificate -manipulation tools. - - - - - - - - - Ensure nss-tools is installed - The nss-tools package can be installed with the following command: - - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - Network Security Services (NSS) is a set of libraries designed to -support cross-platform development of security-enabled client and -server applications. Install the nss-tools package -to install command-line tools to manipulate the NSS certificate -and key database. - - - - - - - - - - Updating Software - The command line tool is used to install and -update software packages. The system also provides a graphical -software update tool in the System menu, in the Administration submenu, -called Software Update. - -Red Hat Enterprise Linux CoreOS 4 systems contain an installed software catalog called -the RPM database, which records metadata of installed packages. Consistently using - or the graphical Software Update for all software installation -allows for insight into the current inventory of installed software on the system. - - - Ensure Red Hat GPG Key Installed - To ensure the system can cryptographically verify base software packages -come from Red Hat (and to connect to the Red Hat Network to receive them), -the Red Hat GPG key must properly be installed. To install the Red Hat GPG -key, run: -$ sudo subscription-manager register - -If the system is not connected to the Internet or an RHN Satellite, then -install the Red Hat GPG key from trusted media such as the Red Hat -installation CD-ROM or DVD. Assuming the disc is mounted in -/media/cdrom, use the following command as the root user to import -it into the keyring: -$ sudo rpm --import /media/cdrom/RPM-GPG-KEY - -Alternatively, the key may be pre-loaded during the RHEL installation. In -such cases, the key can be installed by running the following command: -sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release - BP28(R15) - 11 - 2 - 3 - 9 - 5.10.4.1 - APO01.06 - BAI03.05 - BAI06.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS06.02 - 3.4.8 - CCI-001749 - 164.308(a)(1)(ii)(D) - 164.312(b) - 164.312(c)(1) - 164.312(c)(2) - 164.312(e)(2)(i) - 4.3.4.3.2 - 4.3.4.3.3 - 4.3.4.4.4 - SR 3.1 - SR 3.3 - SR 3.4 - SR 3.8 - SR 7.6 - A.11.2.4 - A.12.1.2 - A.12.2.1 - A.12.5.1 - A.12.6.2 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - CIP-003-8 R4.2 - CIP-003-8 R6 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-5(3) - SI-7 - SC-12 - SC-12(3) - CM-6(a) - PR.DS-6 - PR.DS-8 - PR.IP-1 - FPT_TUD_EXT.1 - FPT_TUD_EXT.2 - Req-6.2 - SRG-OS-000366-GPOS-00153 - SRG-OS-000366-VMM-001430 - SRG-OS-000370-VMM-001460 - SRG-OS-000404-VMM-001650 - Changes to software components can have significant effects on the overall -security of the operating system. This requirement ensures the software has -not been tampered with and that it has been provided by a trusted vendor. -The Red Hat GPG key is necessary to cryptographically verify packages are -from Red Hat. - CCE-82754-3 - - - - - - - - - - - Account and Access Control - In traditional Unix security, if an attacker gains -shell access to a certain login account, they can perform any action -or access any file to which that account has access. Therefore, -making it more difficult for unauthorized people to gain shell -access to accounts, particularly to privileged accounts, is a -necessary part of securing a system. This section introduces -mechanisms for restricting access to accounts under -Red Hat Enterprise Linux CoreOS 4. - - Authselect profile - Specify the authselect profile to select - minimal - minimal - sssd - - - Warning Banners for System Accesses - Each system should expose as little information about -itself as possible. - -System banners, which are typically displayed just before a -login prompt, give out information about the service or the host's -operating system. This might include the distribution name and the -system kernel version, and the particular version of a network -service. This information can assist intruders in gaining access to -the system as it can reveal whether the system is running -vulnerable software. Most network services can be configured to -limit what information is displayed. - -Many organizations implement security policies that require a -system banner provide notice of the system's ownership, provide -warning to unauthorized users, and remind authorized users of their -consent to monitoring. - - Login Banner Verbiage - Enter an appropriate login banner for your organization. Please note that new lines must -be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'. - ^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$ - ^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$ - ^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$ - ^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$ - ^I've[\s\n]+read[\s\n]+\&[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$ - ^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$ - ^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$ - ^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$ - - - Modify the System Login Banner - -To configure the system login banner create a file under -/etc/issue.d - - -The DoD required text is either: - -You are accessing a U.S. Government (USG) Information System (IS) that -is provided for USG-authorized use only. By using this IS (which includes -any device attached to this IS), you consent to the following conditions: --The USG routinely intercepts and monitors communications on this IS -for purposes including, but not limited to, penetration testing, COMSEC -monitoring, network operations and defense, personnel misconduct (PM), law -enforcement (LE), and counterintelligence (CI) investigations. --At any time, the USG may inspect and seize data stored on this IS. --Communications using, or data stored on, this IS are not private, -are subject to routine monitoring, interception, and search, and may be -disclosed or used for any USG-authorized purpose. --This IS includes security measures (e.g., authentication and access -controls) to protect USG interests -- not for your personal benefit or -privacy. --Notwithstanding the above, using this IS does not constitute consent -to PM, LE or CI investigative searching or monitoring of the content of -privileged communications, or work product, related to personal -representation or services by attorneys, psychotherapists, or clergy, and -their assistants. Such communications and work product are private and -confidential. See User Agreement for details. - -OR: - -I've read & consent to terms in IS user agreem't. - - -To address this, please create a Machineconfig object with the -appropriate text in a drop-in file in /etc/issue.d/. Do not try to -edit /etc/issue directly as this is a symlink provided by the -Operating System. - - -For example, if you're using the DoD required text, the manifest would -look as follows: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-etc-issue -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,You%20are%20accessing%20a%20U.S.%20Government%20%28USG%29%20Information%20System%20%28IS%29%20that%20is%20%0Aprovided%20for%20USG-authorized%20use%20only.%20By%20using%20this%20IS%20%28which%20includes%20any%20%0Adevice%20attached%20to%20this%20IS%29%2C%20you%20consent%20to%20the%20following%20conditions%3A%0A%0A-The%20USG%20routinely%20intercepts%20and%20monitors%20communications%20on%20this%20IS%20for%20%0Apurposes%20including%2C%20but%20not%20limited%20to%2C%20penetration%20testing%2C%20COMSEC%20monitoring%2C%20%0Anetwork%20operations%20and%20defense%2C%20personnel%20misconduct%20%28PM%29%2C%20law%20enforcement%20%0A%28LE%29%2C%20and%20counterintelligence%20%28CI%29%20investigations.%0A%0A-At%20any%20time%2C%20the%20USG%20may%20inspect%20and%20seize%20data%20stored%20on%20this%20IS.%0A%0A-Communications%20using%2C%20or%20data%20stored%20on%2C%20this%20IS%20are%20not%20private%2C%20are%20subject%20%0Ato%20routine%20monitoring%2C%20interception%2C%20and%20search%2C%20and%20may%20be%20disclosed%20or%20used%20%0Afor%20any%20USG-authorized%20purpose.%0A%0A-This%20IS%20includes%20security%20measures%20%28e.g.%2C%20authentication%20and%20access%20controls%29%20%0Ato%20protect%20USG%20interests--not%20for%20your%20personal%20benefit%20or%20privacy.%0A%0A-Notwithstanding%20the%20above%2C%20using%20this%20IS%20does%20not%20constitute%20consent%20to%20PM%2C%20LE%20%0Aor%20CI%20investigative%20searching%20or%20monitoring%20of%20the%20content%20of%20privileged%20%0Acommunications%2C%20or%20work%20product%2C%20related%20to%20personal%20representation%20or%20services%20%0Aby%20attorneys%2C%20psychotherapists%2C%20or%20clergy%2C%20and%20their%20assistants.%20Such%20%0Acommunications%20and%20work%20product%20are%20private%20and%20confidential.%20See%20User%20%0AAgreement%20for%20details. - mode: 0644 - path: /etc/issue.d/legal-notice - overwrite: true - - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 1 - 12 - 15 - 16 - DSS05.04 - DSS05.10 - DSS06.10 - 3.1.9 - CCI-000048 - CCI-000050 - CCI-001384 - CCI-001385 - CCI-001386 - CCI-001387 - CCI-001388 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.4 - A.9.3.1 - A.9.4.2 - A.9.4.3 - AC-8(a) - AC-8(c) - PR.AC-7 - FMT_MOF_EXT.1 - SRG-OS-000023-GPOS-00006 - SRG-OS-000228-GPOS-00088 - SRG-OS-000023-VMM-000060 - SRG-OS-000024-VMM-000070 - Display of a standardized and approved use notification before granting -access to the operating system ensures privacy and security notification -verbiage used is consistent with applicable federal laws, Executive Orders, -directives, policies, regulations, standards, and guidance. - -System use notifications are required only for access via login interfaces -with human users and are not required when such human interfaces do not -exist. - - CCE-82555-4 - - - - - - - - - - Verify Group Ownership of System Login Banner - -To properly set the group owner of /etc/issue, run the command: -$ sudo chgrp root /etc/issue - Display of a standardized and approved use notification before granting -access to the operating system ensures privacy and security notification -verbiage used is consistent with applicable federal laws, Executive Orders, -directives, policies, regulations, standards, and guidance. -Proper group ownership will ensure that only root user can modify the banner. - - - - - - - - - Verify ownership of System Login Banner - -To properly set the owner of /etc/issue, run the command: -$ sudo chown root /etc/issue - Display of a standardized and approved use notification before granting -access to the operating system ensures privacy and security notification -verbiage used is consistent with applicable federal laws, Executive Orders, -directives, policies, regulations, standards, and guidance. -Proper ownership will ensure that only root user can modify the banner. - - - - - - - - - Verify permissions on System Login Banner - -To properly set the permissions of /etc/issue, run the command: -$ sudo chmod 0644 /etc/issue - Display of a standardized and approved use notification before granting -access to the operating system ensures privacy and security notification -verbiage used is consistent with applicable federal laws, Executive Orders, -directives, policies, regulations, standards, and guidance. -Proper permissions will ensure that only root user can modify the banner. - - - - - - - - - Implement a GUI Warning Banner - In the default graphical environment, users logging -directly into the system are greeted with a login screen provided -by the GNOME Display Manager (GDM). The warning banner should be -displayed in this graphical environment for these users. -The following sections describe how to configure the GDM login -banner. - - - - - Protect Accounts by Configuring PAM - PAM, or Pluggable Authentication Modules, is a system -which implements modular authentication for Linux programs. PAM provides -a flexible and configurable architecture for authentication, and it should be configured -to minimize exposure to unnecessary risk. This section contains -guidance on how to accomplish that. - -PAM is implemented as a set of shared objects which are -loaded and invoked whenever an application wishes to authenticate a -user. Typically, the application must be running as root in order -to take advantage of PAM, because PAM's modules often need to be able -to access sensitive stores of account information, such as /etc/shadow. -Traditional privileged network listeners -(e.g. sshd) or SUID programs (e.g. sudo) already meet this -requirement. An SUID root application, userhelper, is provided so -that programs which are not SUID or privileged themselves can still -take advantage of PAM. - -PAM looks in the directory /etc/pam.d for -application-specific configuration information. For instance, if -the program login attempts to authenticate a user, then PAM's -libraries follow the instructions in the file /etc/pam.d/login -to determine what actions should be taken. - -One very important file in /etc/pam.d is -/etc/pam.d/system-auth. This file, which is included by -many other PAM configuration files, defines 'default' system authentication -measures. Modifying this file is a good way to make far-reaching -authentication changes, for instance when implementing a -centralized authentication service. - Be careful when making changes to PAM's configuration files. -The syntax for these files is complex, and modifications can -have unexpected consequences. The default configurations shipped -with applications should be sufficient for most users. - Running authconfig or system-config-authentication -will re-write the PAM configuration files, destroying any manually -made changes and replacing them with a series of system defaults. -One reference to the configuration file syntax can be found at - -https://fossies.org/linux/Linux-PAM-docs/doc/sag/Linux-PAM_SAG.pdf. - - Password Hashing algorithm - Specify the system default encryption algorithm for encrypting passwords. -Defines the value set as ENCRYPT_METHOD in /etc/login.defs. - SHA512 - SHA512 - SHA256 - - - remember - The last n passwords for each user are saved in -/etc/security/opasswd in order to force password change history and -keep the user from alternating between the same password too -frequently. - 0 - 10 - 24 - 2 - 4 - 5 - 5 - - - Disallow Configuration to Bypass Password Requirements for Privilege Escalation - Verify the operating system is not configured to bypass password requirements for privilege -escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command: -$ sudo grep pam_succeed_if /etc/pam.d/sudo -If any occurrences of "pam_succeed_if" is returned from the command, this is a finding. - CCI-002038 - IA-11 - SRG-OS-000373-GPOS-00156 - SRG-OS-000373-GPOS-00157 - SRG-OS-000373-GPOS-00158 - Without re-authentication, users may access resources or perform tasks for which they do not -have authorization. When operating systems provide the capability to escalate a functional -capability, it is critical the user re-authenticate. - - - - - - - - - - Ensure PAM Displays Last Logon/Access Notification - To configure the system to notify users of last logon/access -using pam_lastlog, add or correct the pam_lastlog -settings in -/etc/pam.d/postlogin to read as follows: -session required pam_lastlog.so showfailed -And make sure that the silent option is not set for -pam_lastlog module. - 1 - 12 - 15 - 16 - 5.5.2 - DSS05.04 - DSS05.10 - DSS06.10 - CCI-000366 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - 0582 - 0584 - 05885 - 0586 - 0846 - 0957 - A.18.1.4 - A.9.2.1 - A.9.2.4 - A.9.3.1 - A.9.4.2 - A.9.4.3 - AC-9(1) - CM-6(a) - PR.AC-7 - Req-10.2.4 - SRG-OS-000480-GPOS-00227 - Users need to be aware of activity that occurs regarding -their account. Providing users with information regarding the number -of unsuccessful attempts that were made to login to their account -allows the user to determine if any unauthorized activity has occurred -and gives them an opportunity to notify administrators. - - - - - - - - - - Set Lockouts for Failed Password Attempts - The pam_faillock PAM module provides the capability to -lock out user accounts after a number of failed login attempts. Its -documentation is available in -/usr/share/doc/pam-VERSION/txts/README.pam_faillock. - - Locking out user accounts presents the -risk of a denial-of-service attack. The lockout policy -must weigh whether the risk of such a -denial-of-service attack outweighs the benefits of thwarting -password guessing attacks. - - fail_deny - Number of failed login attempts before account lockout - 10 - 3 - 5 - 6 - 3 - - - faillock directory - The directory where the user files with the failure records are kept - /var/log/faillock - /var/log/faillock - - - fail_interval - Interval for counting failed login attempts before account lockout - 100000000 - 1800 - 3600 - 86400 - 900 - 900 - - - fail_unlock_time - Seconds before automatic unlocking or permanently locking after excessive failed logins - 1800 - 3600 - 600 - 604800 - 86400 - 900 - 0 - 0 - - - faildelay_delay - Delay next login attempt after a failed login - 0 - 4000000 - 4000000 - - - pwhistory_remember - Prevent password re-use using password history lookup - 0 - 5 - 6 - 7 - 8 - 9 - 5 - - - PAM pwhistory remember - control flag - Specify the control flag required for password remember requirement. - required - optional - requisite - sufficient - binding - requisite - - - tally2 - Number of failed login attempts - 1 - 2 - 3 - 4 - 5 - 3 - - - Account Lockouts Must Be Logged - PAM faillock locks an account due to excessive password failures, this event must be logged. - CCI-000044 - AC-7 (a) - SRG-OS-000021-GPOS-00005 - Without auditing of these events it may be harder or impossible to identify what an attacker did after an attack. - - - - - - - - - Account Lockouts Must Persist - By setting a `dir` in the faillock configuration account lockouts will persist across reboots. - CCI-000044 - AC-7 (a) - SRG-OS-000021-GPOS-00005 - Having lockouts persist across reboots ensures that account is only unlocked by an administrator. -If the lockouts did not persist across reboots an attack could simply reboot the system to continue brute force attacks against the accounts on the system. - - - - - - - - Set Password Quality Requirements - The default pam_pwquality PAM module provides strength -checking for passwords. It performs a number of checks, such as -making sure passwords are not similar to dictionary words, are of -at least a certain length, are not the previous password reversed, -and are not simply a change of case from the previous password. It -can also require passwords to be in certain character classes. The -pam_pwquality module is the preferred way of configuring -password requirements. - -The man pages pam_pwquality(8) -provide information on the capabilities and configuration of -each. - - Set Password Quality Requirements, if using -pam_cracklib - The pam_cracklib PAM module can be configured to meet -requirements for a variety of policies. - -For example, to configure pam_cracklib to require at least one uppercase -character, lowercase character, digit, and other (special) -character, locate the following line in /etc/pam.d/system-auth: -password requisite pam_cracklib.so try_first_pass retry=3 -and then alter it to read: -password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4 -If no such line exists, add one as the first line of the password section in /etc/pam.d/system-auth. -The arguments can be modified to ensure compliance with -your organization's security policy. Discussion of each parameter follows. - Note that the password quality requirements are not enforced for the -root account for some reason. - - - Set Password Quality Requirements with pam_pwquality - The pam_pwquality PAM module can be configured to meet -requirements for a variety of policies. - -For example, to configure pam_pwquality to require at least one uppercase -character, lowercase character, digit, and other (special) -character, make sure that pam_pwquality exists in /etc/pam.d/system-auth: -password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= -If no such line exists, add one as the first line of the password section in /etc/pam.d/system-auth. -Next, modify the settings in /etc/security/pwquality.conf to match the following: -difok = 4 -minlen = 14 -dcredit = -1 -ucredit = -1 -lcredit = -1 -ocredit = -1 -maxrepeat = 3 -The arguments can be modified to ensure compliance with -your organization's security policy. Discussion of each parameter follows. - - dcredit - Minimum number of digits in password - 0 - -1 - -2 - -1 - - - dictcheck - Prevent the use of dictionary words for passwords. - 1 - 1 - - - difok - Minimum number of characters not present in old -password - 15 - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 8 - - - lcredit - Minimum number of lower case in password - 0 - -1 - -2 - -1 - - - maxclassrepeat - Maximum Number of Consecutive Repeating Characters in a Password From the Same Character Class - 1 - 2 - 3 - 4 - 4 - - - maxrepeat - Maximum Number of Consecutive Repeating Characters in a Password - 1 - 2 - 3 - 3 - - - minclass - Minimum number of categories of characters that must exist in a password - 1 - 2 - 3 - 4 - 3 - - - minlen - Minimum number of characters in password - 10 - 12 - 14 - 15 - 18 - 20 - 6 - 7 - 8 - 15 - - - ocredit - Minimum number of other (special characters) in -password - 0 - -1 - -2 - -1 - - - retry - Number of retry attempts before erroring out - 1 - 2 - 3 - 4 - 5 - 3 - - - ucredit - Minimum number of upper case in password - 0 - -1 - -2 - -1 - - - - - Set Password Hashing Algorithm - The system's default algorithm for storing password hashes in -/etc/shadow is SHA-512. This can be configured in several -locations. - - - - Protect Physical Console Access - It is impossible to fully protect a system from an -attacker with physical access, so securing the space in which the -system is located should be considered a necessary step. However, -there are some steps which, if taken, make it more difficult for an -attacker to quickly or undetectably modify a system from its -console. - - Disable debug-shell SystemD Service - SystemD's debug-shell service is intended to -diagnose SystemD related boot issues with various systemctl -commands. Once enabled and following a system reboot, the root shell -will be available on tty9 which is access by pressing -CTRL-ALT-F9. The debug-shell service should only be used -for SystemD related issues and should otherwise be disabled. - -By default, the debug-shell SystemD service is already disabled. - -The debug-shell service can be disabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-debug-shell-disable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: debug-shell.service - - -This will disable the debug-shell service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 3.4.5 - CCI-000366 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - CM-6 - FIA_UAU.1 - SRG-OS-000324-GPOS-00125 - SRG-OS-000480-GPOS-00227 - This prevents attackers with physical access from trivially bypassing security -on the machine through valid troubleshooting configurations and gaining root -access when the system is rebooted. - - CCE-82496-1 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: debug-shell.service - enabled: false - mask: true - - name: debug-shell.socket - enabled: false - mask: true - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: debug-shell.service - - - - - - - - - - Verify that Interactive Boot is Disabled - Red Hat Enterprise Linux CoreOS 4 systems support an "interactive boot" option that can -be used to prevent services from being started. On a Red Hat Enterprise Linux CoreOS 4 -system, interactive boot can be enabled by providing a 1, -yes, true, or on value to the -systemd.confirm_spawn kernel argument. - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - DSS06.06 - 3.1.2 - 3.4.5 - CCI-000213 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - SC-2(1) - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000480-GPOS-00227 - Using interactive boot, the console user could disable auditing, firewalls, -or other services, weakening system security. - CCE-83548-8 - - - - - - - - - Disable Ctrl-Alt-Del Burst Action - By default, SystemD will reboot the system if the Ctrl-Alt-Del -key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds. - -To configure the system to ignore the CtrlAltDelBurstAction - -setting, create a MachineConfig similar to the following: - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-disable-ctrlaltdel-burstaction -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,CtrlAltDelBurstAction%3Dnone - mode: 0644 - path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf - overwrite: true -EOF - - -This will add the relevant configuration to /etc/systemd/system.conf.d/, -thus configuring Systemd apropriately. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - Disabling the Ctrl-Alt-Del key sequence -in /etc/init/control-alt-delete.conf DOES NOT disable the Ctrl-Alt-Del -key sequence if running in runlevel 6 (e.g. in GNOME, KDE, etc.)! The -Ctrl-Alt-Del key sequence will only be disabled if running in -the non-graphical runlevel 3. - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.4.5 - CCI-000366 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - CM-6(a) - PR.AC-4 - PR.DS-5 - FAU_GEN.1.2 - SRG-OS-000324-GPOS-00125 - SRG-OS-000480-GPOS-00227 - A locally logged-in user who presses Ctrl-Alt-Del, when at the console, -can reboot the system. If accidentally pressed, as could happen in -the case of mixed OS environment, this can create the risk of short-term -loss of availability of systems due to unintentional reboot. - - CCE-82495-3 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,CtrlAltDelBurstAction%3Dnone - mode: 0644 - path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf - overwrite: true - - - - - - - - - - Disable Ctrl-Alt-Del Reboot Activation - By default, SystemD will reboot the system if the Ctrl-Alt-Del -key sequence is pressed. - -To configure the system to ignore the Ctrl-Alt-Del key sequence from the - -command line instead of rebooting the system, create a MachineConfig -similar to the following: - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-disable-ctrlaltdel-reboot -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: ctrl-alt-del.target - mask: true -EOF - - -This will mask the ctrl-alt-del.target systemd target for all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.4.5 - CCI-000366 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - FAU_GEN.1.2 - SRG-OS-000324-GPOS-00125 - SRG-OS-000480-GPOS-00227 - A locally logged-in user who presses Ctrl-Alt-Del, when at the console, -can reboot the system. If accidentally pressed, as could happen in -the case of mixed OS environment, this can create the risk of short-term -loss of availability of systems due to unintentional reboot. - - CCE-82493-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: ctrl-alt-del.target - mask: true - - - - - - - - - - Verify that Interactive Boot is Disabled - Red Hat Enterprise Linux CoreOS 4 systems support an "interactive boot" option that can -be used to prevent services from being started. On a Red Hat Enterprise Linux CoreOS 4 -system, interactive boot can be enabled by providing a 1, -yes, true, or on value to the -systemd.confirm_spawn kernel argument in /etc/default/grub. -Remove any instance of systemd.confirm_spawn=(1|yes|true|on) from -the kernel arguments in that file to disable interactive boot. -Recovery booting must also be disabled. Confirm that -GRUB_DISABLE_RECOVERY=true is set in /etc/default/grub. -It is also required to change the runtime configuration, run: - -/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn" - -grub2-mkconfig -o /boot/grub2/grub.cfg - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - DSS06.06 - 3.1.2 - 3.4.5 - CCI-000213 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - SC-2(1) - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000480-GPOS-00227 - Using interactive or recovery boot, the console user could disable auditing, firewalls, -or other services, weakening system security. - - CCE-82551-3 - - - - - - - - - Require Authentication for Single User Mode - Single-user mode is intended as a system recovery -method, providing a single user root access to the system by -providing a boot option at startup. - -By default, single-user mode is protected by requiring a password and is set -in /usr/lib/systemd/system/rescue.service. - 1 - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.06 - DSS06.10 - 3.1.1 - 3.4.5 - CCI-000213 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - 0421 - 0422 - 0431 - 0974 - 1173 - 1401 - 1504 - 1505 - 1546 - 1557 - 1558 - 1559 - 1560 - 1561 - A.18.1.4 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - IA-2 - AC-3 - CM-6(a) - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000080-GPOS-00048 - This prevents attackers with physical access from trivially bypassing security -on the machine and gaining root access. Such accesses are further prevented -by configuring the bootloader password. - - CCE-82550-5 - - - - - - - - - Configure Screen Locking - When a user must temporarily leave an account -logged-in, screen locking should be employed to prevent passersby -from abusing the account. User education and training is -particularly important for screen locking to be effective, and policies -can be implemented to reinforce this. - -Automatic screen locking is only meant as a safeguard for -those cases where a user forgot to lock the screen. - - Configure Console Screen Locking - A console screen locking mechanism is a temporary action taken when a user -stops work and moves away from the immediate physical vicinity of the -information system but does not logout because of the temporary nature of -the absence. Rather than relying on the user to manually lock their -operation system session prior to vacating the vicinity, operating systems -need to be able to identify when a user's session has idled and take action -to initiate the session lock. - - Install the tmux Package - To enable console screen locking, install the tmux package. -A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. -The session lock is implemented at the point where session activity can be determined. -Rather than be forced to wait for a period of time to expire before the user session can be locked, Red Hat Enterprise Linux CoreOS 4 needs to provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity. -Instruct users to begin new terminal sessions with the following command: -$ tmux -The console can now be locked with the following key combination: -ctrl+b :lock-session - 1 - 12 - 15 - 16 - DSS05.04 - DSS05.10 - DSS06.10 - 3.1.10 - CCI-000058 - CCI-000056 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.4 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CM-6(a) - PR.AC-7 - FMT_SMF_EXT.1 - FMT_MOF_EXT.1 - FTA_SSL.1 - SRG-OS-000030-GPOS-00011 - SRG-OS-000028-GPOS-00009 - SRG-OS-000030-VMM-000110 - A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate -physical vicinity of the information system but does not logout because of the temporary nature of the absence. -Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity, -operating systems need to be able to identify when a user's session has idled and take action to initiate the -session lock. - -The tmux package allows for a session lock to be implemented and configured. - - - - - - - - - - Support session locking with tmux - The tmux terminal multiplexer is used to implement -automatic session locking. It should be started from -/etc/bashrc or drop-in files within /etc/profile.d/. - CCI-000056 - CCI-000058 - FMT_SMF_EXT.1 - FMT_MOF_EXT.1 - FTA_SSL.1 - SRG-OS-000031-GPOS-00012 - SRG-OS-000028-GPOS-00009 - SRG-OS-000030-GPOS-00011 - Unlike bash itself, the tmux terminal multiplexer -provides a mechanism to lock sessions after period of inactivity. -A session lock is a temporary action taken when a user stops work and moves away from the -immediate physical vicinity of the information system but does not want to -log out because of the temporary nature of the absence. - - - - - - - - - - Configure tmux to lock session after inactivity - To enable console screen locking in tmux terminal multiplexer -after a period of inactivity, -the lock-after-time option has to be set to a value greater than 0 and less than -or equal to 900 in /etc/tmux.conf. - CCI-000057 - CCI-000060 - FMT_SMF_EXT.1 - FMT_MOF_EXT.1 - FTA_SSL.1 - SRG-OS-000029-GPOS-00010 - SRG-OS-000031-GPOS-00012 - Locking the session after a period of inactivity limits the -potential exposure if the session is left unattended. - - - - - - - - - - Configure the tmux Lock Command - To enable console screen locking in tmux terminal multiplexer, -the vlock command must be configured to be used as a locking -mechanism. -Add the following line to /etc/tmux.conf: -set -g lock-command vlock. -The console can now be locked with the following key combination: -ctrl+b :lock-session - CCI-000056 - CCI-000058 - AC-11(a) - AC-11(b) - CM-6(a) - FMT_SMF_EXT.1 - FMT_MOF_EXT.1 - FTA_SSL.1 - SRG-OS-000028-GPOS-00009 - SRG-OS-000030-GPOS-00011 - SRG-OS-000028-VMM-000090 - SRG-OS-000030-VMM-000110 - The tmux package allows for a session lock to be implemented and configured. -However, the session lock is implemented by an external command. The tmux -default configuration does not contain an effective session lock. - - - - - - - - - - Prevent user from disabling the screen lock - The tmux terminal multiplexer is used to implement -automatic session locking. It should not be listed in -/etc/shells. - CCI-000056 - CCI-000058 - CM-6 - FMT_SMF_EXT.1 - FMT_MOF_EXT.1 - FTA_SSL.1 - SRG-OS-000324-GPOS-00125 - SRG-OS-000028-GPOS-00009 - SRG-OS-000030-GPOS-00011 - Not listing tmux among permitted shells -prevents malicious program running as user -from lowering security by disabling the screen lock. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,/bin/sh%0A/bin/bash%0A/usr/bin/sh%0A/usr/bin/bash%0A - mode: 0644 - path: /etc/shells - overwrite: true - - - - - - - - - - - Hardware Tokens for Authentication - The use of hardware tokens such as smart cards for system login -provides stronger, two-factor authentication than using a username and password. - -In Red Hat Enterprise Linux servers and workstations, hardware token login - -is not enabled by default and must be enabled in the system settings. - - - OpenSC Smart Card Drivers - Choose the Smart Card Driver in use by your organization. -For DoD, choose the cac driver. -If your driver is not listed and you don't want to use the -default driver, use the other option and -manually specify your driver. - default - acos5 - akis - asepcos - atrust-acos - authentic - belpic - cac - cardos - coolkey - cyberflex - dnie - entersafe - epass2003 - flex - gemsafeV1 - gids - gpk - iasecc - incrypto34 - isoApplet - itacns - jpki - MaskTech - mcrd - muscle - myeid - npa - oberthur - openpgp - None - PIV-II - rutoken_ecp - rutoken - sc-hsm - setcos - starcos - tcos - westcos - - - - - - Protect Accounts by Restricting Password-Based Login - Conventionally, Unix shell accounts are accessed by -providing a username and password to a login program, which tests -these values for correctness using the /etc/passwd and -/etc/shadow files. Password-based login is vulnerable to -guessing of weak passwords, and to sniffing and man-in-the-middle -attacks against passwords entered over a network or at an insecure -console. Therefore, mechanisms for accessing accounts by entering -usernames and passwords should be restricted to those which are -operationally necessary. - - Accounts Authorized Local Users on the Operating System - List the user accounts that are authorized locally on the operating system. This list -includes both users requried by the operating system and by the installed applications. -Depending on the Operating System distribution, version, software groups and applications, -the user list is different and can be customized with scap-workbench. -OVAL regular expression is used for the user list. -The list starts with '^' and ends with '$' so that it matches exactly the -username, not any string that includes the username. Users are separated with '|'. -For example, three users: bin, oracle and sapadm are allowed, then the list is -^(bin|oracle|sapadm)$. The user root is the only user that is hard coded -in OVAL that is always allowed on the operating system. - ^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$ - ^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$ - ^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$ - ^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$ - ^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$ - ^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd|man|systemd-timesync|scard|hacluster|statd|at|dockremap|vnc)$ - ^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd|man|systemd-timesync|scard|hacluster|statd|at|dockremap|vnc|messagebus|nscd)$ - - - Set Account Expiration Parameters - Accounts can be configured to be automatically disabled -after a certain time period, -meaning that they will require administrator interaction to become usable again. -Expiration of accounts after inactivity can be set for all accounts by default -and also on a per-account basis, such as for accounts that are known to be temporary. -To configure automatic expiration of an account following -the expiration of its password (that is, after the password has expired and not been changed), -run the following command, substituting NUM_DAYS and USER appropriately: -$ sudo chage -I NUM_DAYS USER -Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the --E option. -The file /etc/default/useradd controls -default settings for all newly-created accounts created with the system's -normal command line utilities. - This will only apply to newly created accounts - - number of days after the last login of the user when the user will be locked out - 'This option is specific for the auth or account phase. It specifies the number of days after -the last login of the user when the user will be locked out by the pam_lastlog module.' - 0 - 180 - 30 - 35 - 40 - 60 - 90 - 35 - - - number of days after a password expires until the account is permanently disabled - The number of days to wait after a password expires, until the account will be permanently disabled. - 0 - 180 - 30 - 35 - 40 - 60 - 90 - 35 - - - Set Account Expiration Following Inactivity - To specify the number of days after a password expires (which -signifies inactivity) until an account is permanently disabled, add or correct -the following line in /etc/default/useradd: -INACTIVE= -If a password is currently on the verge of expiration, then - -day(s) remain(s) until the account is automatically -disabled. However, if the password will not expire for another 60 days, then 60 -days plus day(s) could -elapse until the account would be automatically disabled. See the -useradd man page for more information. - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 7 - 8 - 5.6.2.1.1 - DSS01.03 - DSS03.05 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.5.6 - CCI-000017 - CCI-000795 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 6.2 - A.12.4.1 - A.12.4.3 - A.18.1.4 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - IA-4(e) - AC-2(3) - CM-6(a) - DE.CM-1 - DE.CM-3 - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - Req-8.1.4 - SRG-OS-000118-GPOS-00060 - SRG-OS-000003-VMM-000030 - SRG-OS-000118-VMM-000590 - Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. -Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. -Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. - - CCE-82695-8 - - - - - - - - - - Ensure All Accounts on the System Have Unique Names - Ensure accounts on the system have unique names. - -To ensure all accounts have unique names, run the following command: -$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d -If a username is returned, change or delete the username. - 5.5.2 - CCI-000770 - CCI-000804 - Req-8.1.1 - Unique usernames allow for accountability on the system. - - - - - - - - - Use Centralized and Automated Authentication - Implement an automated system for managing user accounts that minimizes the -risk of errors, either intentional or deliberate. This system -should integrate with an existing enterprise user management system, such as -one based on Identity Management tools such as Active Directory, Kerberos, -Directory Server, etc. - A comprehensive account management process that includes automation helps to -ensure the accounts designated as requiring attention are consistently and -promptly addressed. Enterprise environments make user account management -challenging and complex. A user management process requiring administrators to -manually address account management functions adds risk of potential -oversight. - - - - - - - Set Password Expiration Parameters - The file /etc/login.defs controls several -password-related settings. Programs such as passwd, -su, and -login consult /etc/login.defs to determine -behavior with regard to password aging, expiration warnings, -and length. See the man page login.defs(5) for more information. - -Users should be forced to change their passwords, in order to -decrease the utility of compromised passwords. However, the need to -change passwords often should be balanced against the risk that -users will reuse or write down passwords if forced to change them -too often. Forcing password changes every 90-360 days, depending on -the environment, is recommended. Set the appropriate value as -PASS_MAX_DAYS and apply it to existing accounts with the --M flag. - -The PASS_MIN_DAYS (-m) setting prevents password -changes for 7 days after the first change, to discourage password -cycling. If you use this setting, train users to contact an administrator -for an emergency password change in case a new password becomes -compromised. The PASS_WARN_AGE (-W) setting gives -users 7 days of warnings at login time that their passwords are about to expire. - -For example, for each existing human user USER, expiration parameters -could be adjusted to a 180 day maximum password age, 7 day minimum password -age, and 7 day warning period with the following command: -$ sudo chage -M 180 -m 7 -W 7 USER - - maximum password age - Maximum age of password in days - 365 - 120 - 180 - 60 - 90 - 60 - - - minimum password age - Minimum age of password in days - 0 - 1 - 2 - 5 - 7 - 7 - - - minimum password length - Minimum number of characters in password - This will only check new passwords - 10 - 12 - 14 - 15 - 18 - 20 - 6 - 8 - 15 - - - warning days before password expires - The number of days' warning given before a password expires. - This will only apply to newly created accounts - 0 - 14 - 7 - 7 - - - Set Password Maximum Age - To specify password maximum age for new accounts, -edit the file /etc/login.defs -and add or correct the following line: -PASS_MAX_DAYS -A value of 180 days is sufficient for many environments. -The DoD requirement is 60. -The profile requirement is . - BP28(R18) - 1 - 12 - 15 - 16 - 5 - 5.6.2.1 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.5.6 - CCI-000199 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - 0418 - 1055 - 1402 - A.18.1.4 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - IA-5(f) - IA-5(1)(d) - CM-6(a) - PR.AC-1 - PR.AC-6 - PR.AC-7 - Req-8.2.4 - SRG-OS-000076-GPOS-00044 - Any password, no matter how complex, can eventually be cracked. Therefore, passwords -need to be changed periodically. If the operating system does not limit the lifetime -of passwords and force users to change their passwords, there is the risk that the -operating system passwords could be compromised. - -Setting the password maximum age ensures users are required to -periodically change their passwords. Requiring shorter password lifetimes -increases the risk of users writing down the password in a convenient -location subject to physical compromise. - - - - - - - - - - - Set Password Minimum Age - To specify password minimum age for new accounts, -edit the file /etc/login.defs -and add or correct the following line: -PASS_MIN_DAYS -A value of 1 day is considered sufficient for many -environments. The DoD requirement is 1. -The profile requirement is . - 1 - 12 - 15 - 16 - 5 - 5.6.2.1.1 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.5.8 - CCI-000198 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - 0418 - 1055 - 1402 - A.18.1.4 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - IA-5(f) - IA-5(1)(d) - CM-6(a) - PR.AC-1 - PR.AC-6 - PR.AC-7 - SRG-OS-000075-GPOS-00043 - Enforcing a minimum password lifetime helps to prevent repeated password -changes to defeat the password reuse or history enforcement requirement. If -users are allowed to immediately and continually change their password, -then the password could be repeatedly changed in a short period of time to -defeat the organization's policy regarding password reuse. - -Setting the minimum password age protects against users cycling back to a -favorite password after satisfying the password reuse requirement. - - - - - - - - - - - Set Password Minimum Length in login.defs - To specify password length requirements for new accounts, edit the file -/etc/login.defs and add or correct the following line: -PASS_MIN_LEN - -The DoD requirement is 15. -The FISMA requirement is 12. -The profile requirement is -. -If a program consults /etc/login.defs and also another PAM module -(such as pam_pwquality) during a password change operation, then -the most restrictive must be satisfied. See PAM section for more -information about enforcing password quality requirements. - BP28(R18) - 1 - 12 - 15 - 16 - 5 - 5.6.2.1 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.5.7 - CCI-000205 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - 0421 - 0422 - 0431 - 0974 - 1173 - 1401 - 1504 - 1505 - 1546 - 1557 - 1558 - 1559 - 1560 - 1561 - A.18.1.4 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - IA-5(f) - IA-5(1)(a) - CM-6(a) - PR.AC-1 - PR.AC-6 - PR.AC-7 - SRG-OS-000078-GPOS-00046 - Requiring a minimum password length makes password -cracking attacks more difficult by ensuring a larger -search space. However, any security benefit from an onerous requirement -must be carefully weighed against usability problems, support costs, or counterproductive -behavior that may result. - - - - - - - - - - - Set Password Warning Age - To specify how many days prior to password -expiration that a warning will be issued to users, -edit the file /etc/login.defs and add or correct - the following line: -PASS_WARN_AGE -The DoD requirement is 7. -The profile requirement is . - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 7 - 8 - DSS01.03 - DSS03.05 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.5.8 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 6.2 - 0418 - 1055 - 1402 - A.12.4.1 - A.12.4.3 - A.18.1.4 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - IA-5(f) - IA-5(1)(d) - CM-6(a) - DE.CM-1 - DE.CM-3 - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - Setting the password warning age enables users to -make the change at a practical time. - - - - - - - - - - - - Verify Proper Storage and Existence of Password -Hashes - By default, password hashes for local accounts are stored -in the second field (colon-separated) in -/etc/shadow. This file should be readable only by -processes running with root credentials, preventing users from -casually accessing others' password hashes and attempting -to crack them. -However, it remains possible to misconfigure the system -and store password hashes -in world-readable files such as /etc/passwd, or -to even store passwords themselves in plaintext on the system. -Using system-provided tools for password change/creation -should allow administrators to avoid such misconfiguration. - - Password Hashing algorithm - Specify the number of SHA rounds for the system password encryption algorithm. -Defines the value set in /etc/pam.d/system-auth and /etc/pam.d/password-auth - 5000 - 5000 - 65536 - - - Verify All Account Password Hashes are Shadowed - If any password hashes are stored in /etc/passwd (in the second field, -instead of an x or *), the cause of this misconfiguration should be -investigated. The account should have its password reset and the hash should be -properly stored, or the account should be deleted entirely. - 1 - 12 - 15 - 16 - 5 - 5.5.2 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.5.10 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - 1410 - A.18.1.4 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - IA-5(h) - CM-6(a) - PR.AC-1 - PR.AC-6 - PR.AC-7 - Req-8.2.1 - The hashes for all user account passwords should be stored in -the file /etc/shadow and never in /etc/passwd, -which is readable by all users. - - - - - - - - - - All GIDs referenced in /etc/passwd must be defined in /etc/group - Add a group to the system for each GID referenced without a corresponding group. - 1 - 12 - 15 - 16 - 5 - 5.5.2 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - CCI-000764 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - A.18.1.4 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - IA-2 - CM-6(a) - PR.AC-1 - PR.AC-6 - PR.AC-7 - Req-8.5.a - SRG-OS-000104-GPOS-00051 - If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group -with the Group Identifier (GID) is subsequently created, the user may have unintended rights to -any files associated with the group. - - - - - - - - - Prevent Login to Accounts With Empty Password - If an account is configured for password authentication -but does not have an assigned password, it may be possible to log -into the account without authentication. Remove any instances of the -nullok in - -/etc/pam.d/system-auth and -/etc/pam.d/password-auth - -to prevent logins with empty passwords. - If the system relies on authselect tool to manage PAM settings, the remediation -will also use authselect tool. However, if any manual modification was made in -PAM files, the authselect integrity check will fail and the remediation will be -aborted in order to preserve intentional changes. In this case, an informative message will -be shown in the remediation report. -Note that this rule is not applicable for systems running within a -container. Having user with empty password within a container is not -considered a risk, because it should not be possible to directly login into -a container anyway. - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2 - APO01.06 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.02 - DSS06.03 - DSS06.10 - 3.1.1 - 3.1.5 - CCI-000366 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.18.1.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - IA-5(1)(a) - IA-5(c) - CM-6(a) - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.DS-5 - FIA_UAU.1 - Req-8.2.3 - SRG-OS-000480-GPOS-00227 - If an account has an empty password, anyone could log in and -run commands with the privileges of that account. Accounts with -empty passwords should never be used in operational environments. - - CCE-82553-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A - mode: 0644 - path: /etc/pam.d/password-auth - overwrite: true - - contents: - source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A - mode: 0644 - path: /etc/pam.d/system-auth - overwrite: true - - - - - - - - - - Ensure There Are No Accounts With Blank or Null Passwords - Check the "/etc/shadow" file for blank passwords with the -following command: -$ sudo awk -F: '!$2 {print $1}' /etc/shadow -If the command returns any results, this is a finding. -Configure all accounts on the system to have a password or lock -the account with the following commands: -Perform a password reset: -$ sudo passwd [username] -Lock an account: -$ sudo passwd -l [username] - Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway. - CCI-000366 - CM-6(b) - CM-6.1(iv) - SRG-OS-000480-GPOS-00227 - If an account has an empty password, anyone could log in and -run commands with the privileges of that account. Accounts with -empty passwords should never be used in operational environments. - - - - - - - - - - Ensure there are no legacy + NIS entries in /etc/group - The + character in /etc/group file marks a place where -entries from a network information service (NIS) should be directly inserted. - Using this method to include entries into /etc/group is considered legacy -and should be avoided. These entries may provide a way for an attacker -to gain access to the system. - - - - - - - - - Ensure there are no legacy + NIS entries in /etc/passwd - The + character in /etc/passwd file marks a place where -entries from a network information service (NIS) should be directly inserted. - Using this method to include entries into /etc/passwd is considered legacy -and should be avoided. These entries may provide a way for an attacker -to gain access to the system. - - - - - - - - - Ensure there are no legacy + NIS entries in /etc/shadow - The + character in /etc/shadow file marks a place where -entries from a network information service (NIS) should be directly inserted. - Using this method to include entries into /etc/shadow is considered legacy -and should be avoided. These entries may provide a way for an attacker -to gain access to the system. - - - - - - - - - Verify No netrc Files Exist - The .netrc files contain login information -used to auto-login into FTP servers and reside in the user's home -directory. These files may contain unencrypted passwords to -remote FTP servers making them susceptible to access by unauthorized -users and should not be used. Any .netrc files should be removed. - 1 - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.06 - DSS06.10 - CCI-000196 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - A.18.1.4 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-003-8 R1.3 - CIP-003-8 R3 - CIP-003-8 R3.1 - CIP-003-8 R3.2 - CIP-003-8 R3.3 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - IA-5(h) - IA-5(1)(c) - CM-6(a) - IA-5(7) - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.PT-3 - Unencrypted passwords for remote FTP servers may be stored in .netrc -files. - CCE-82667-7 - - - - - - - - - - Restrict Root Logins - Direct root logins should be allowed only for emergency use. -In normal situations, the administrator should access the system -via a unique unprivileged account, and then use su or sudo to execute -privileged commands. Discouraging administrators from accessing the -root account directly ensures an audit trail in organizations with -multiple administrators. Locking down the channels through which -root can connect directly also reduces opportunities for -password-guessing against the root account. The login program -uses the file /etc/securetty to determine which interfaces -should allow root logins. - -The virtual devices /dev/console -and /dev/tty* represent the system consoles (accessible via -the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default -installation). The default securetty file also contains /dev/vc/*. -These are likely to be deprecated in most environments, but may be retained -for compatibility. Root should also be prohibited from connecting -via network protocols. Other sections of this document -include guidance describing how to prevent root from logging in via SSH. - - Verify Only Root Has UID 0 - If any account other than root has a UID of 0, this misconfiguration should -be investigated and the accounts other than root should be removed or have -their UID changed. - -If the account is associated with system commands or applications the UID -should be changed to one greater than "0" but less than "1000." -Otherwise assign a UID greater than "1000" that has not already been -assigned. - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.02 - DSS06.03 - DSS06.10 - 3.1.1 - 3.1.5 - CCI-000366 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.18.1.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - IA-2 - AC-6(5) - IA-4(b) - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - An account has root authority if it has a UID of 0. Multiple accounts -with a UID of 0 afford more opportunity for potential intruders to -guess a password for a privileged account. Proper configuration of -sudo is recommended to afford multiple system administrators -access to root privileges in an accountable manner. - CCE-82699-0 - - - - - - - - - Verify Root Has A Primary GID 0 - The root user should have a primary group of 0. - To help ensure that root-owned files are not inadvertently exposed to other users. - - - - - - - - - Direct root Logins Not Allowed - To further limit access to the root account, administrators -can disable root logins at the console by editing the /etc/securetty file. -This file lists all devices the root user is allowed to login to. If the file does -not exist at all, the root user can login through any communication device on the -system, whether via the console or via a raw network interface. This is dangerous -as user can login to the system as root via Telnet, which sends the password in -plain text over the network. By default, Red Hat Enterprise Linux CoreOS 4's -/etc/securetty file only allows the root user to login at the console -physically attached to the system. To prevent root from logging in, remove the -contents of this file. To prevent direct root logins, remove the contents of this -file by typing the following command: - -$ sudo echo > /etc/securetty - - BP28(R19) - 1 - 12 - 15 - 16 - 5 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.1.1 - 3.1.6 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - A.18.1.4 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - IA-2 - CM-6(a) - PR.AC-1 - PR.AC-6 - PR.AC-7 - Disabling direct root logins ensures proper accountability and multifactor -authentication to privileged accounts. Users will first login, then escalate -to privileged (root) access via su / sudo. This is required for FISMA Low -and FISMA Moderate systems. - - CCE-82698-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:, - mode: 0600 - path: /etc/securetty - overwrite: true - - - - - - - - - - Ensure that System Accounts Are Locked - Some accounts are not associated with a human user of the system, and exist to -perform some administrative function. An attacker should not be able to log into -these accounts. - -System accounts are those user accounts with a user ID -less than UID_MIN, where value of the UID_MIN directive is set in -/etc/login.defs configuration file. In the default configuration UID_MIN is set -to 500, thus system accounts are those user accounts with a user ID less than -500. If any system account SYSACCT (other than root) has an unlocked password, -disable it with the command: -$ sudo passwd -l SYSACCT - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6 - CM-6(a) - Disabling authentication for default system accounts makes it more difficult -for attackers to make use of them to compromise a system.false - - - - - - Ensure that System Accounts Do Not Run a Shell Upon Login - Some accounts are not associated with a human user of the system, and exist to -perform some administrative function. Should an attacker be able to log into -these accounts, they should not be granted access to a shell. - -The login shell for each local account is stored in the last field of each line -in /etc/passwd. System accounts are those user accounts with a user ID -less than UID_MIN, where value of UID_MIN directive is set in -/etc/login.defs configuration file. In the default configuration UID_MIN is set -to 1000, thus system accounts are those user accounts with a user ID less than -1000. The user ID is stored in the third field. If any system account -SYSACCT (other than root) has a login shell, disable it with the -command: $ sudo usermod -s /sbin/nologin SYSACCT - Do not perform the steps in this section on the root account. Doing so might -cause the system to become inaccessible. - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 7 - 8 - DSS01.03 - DSS03.05 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - CCI-000366 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 6.2 - 1491 - A.12.4.1 - A.12.4.3 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - AC-6 - CM-6(a) - CM-6(b) - CM-6.1(iv) - DE.CM-1 - DE.CM-3 - PR.AC-1 - PR.AC-4 - PR.AC-6 - SRG-OS-000480-GPOS-00227 - Ensuring shells are not given to system accounts upon login makes it more -difficult for attackers to make use of system accounts. - CCE-82697-4 - - - - - - - - - Restrict Serial Port Root Logins - To restrict root logins on serial ports, -ensure lines of this form do not appear in /etc/securetty: -ttyS0 -ttyS1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.1 - 3.1.5 - CCI-000770 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6 - CM-6(a) - PR.AC-4 - PR.DS-5 - Preventing direct root login to serial port interfaces -helps ensure accountability for actions taken on the systems -using the root account. - - - - - - - - - Restrict Virtual Console Root Logins - To restrict root logins through the (deprecated) virtual console devices, -ensure lines of this form do not appear in /etc/securetty: -vc/1 -vc/2 -vc/3 -vc/4 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.1 - 3.1.5 - CCI-000770 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6 - CM-6(a) - PR.AC-4 - PR.DS-5 - SRG-OS-000324-GPOS-00125 - Preventing direct root login to virtual console devices -helps ensure accountability for actions taken on the system -using the root account. - - - - - - - - - - - Secure Session Configuration Files for Login Accounts - When a user logs into a Unix account, the system -configures the user's session by reading a number of files. Many of -these files are located in the user's home directory, and may have -weak permissions as a result of user error or misconfiguration. If -an attacker can modify or even read certain types of account -configuration information, they can often gain full access to the -affected user's account. Therefore, it is important to test and -correct configuration file permissions for interactive accounts, -particularly those of privileged users such as root or system -administrators. - - Maximum login attempts delay - Maximum time in seconds between fail login attempts before re-prompting. - 1 - 2 - 3 - 4 - 5 - 4 - - - Maximum concurrent login sessions - Maximum number of concurrent sessions by a user - 1 - 10 - 15 - 20 - 3 - 5 - 1 - - - Account Inactivity Timeout (seconds) - In an interactive shell, the value is interpreted as the -number of seconds to wait for input after issuing the primary prompt. -Bash terminates after waiting for that number of seconds if input does -not arrive. - 1800 - 600 - 900 - 300 - 600 - - - Interactive users initialization files - 'A regular expression describing a list of file names -for files that are sourced at login time for interactive users' - (\.bashrc|\.zshrc|\.cshrc|\.profile|\.bash_login|\.bash_profile) - - - Ensure the Logon Failure Delay is Set Correctly in login.defs - To ensure the logon failure delay controlled by /etc/login.defs is set properly, -add or correct the FAIL_DELAY setting in /etc/login.defs to read as follows: -FAIL_DELAY - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - CCI-000366 - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - AC-7(b) - CM-6(a) - PR.IP-1 - SRG-OS-000480-GPOS-00226 - Increasing the time between a failed authentication attempt and re-prompting to -enter credentials helps to slow a single-threaded brute force attack. - - - - - - - - - - - Limit the Number of Concurrent Login Sessions Allowed Per User - Limiting the number of allowed users and sessions per user can limit risks related to Denial of -Service attacks. This addresses concurrent sessions for a single account and does not address -concurrent sessions by a single user via multiple accounts. To set the number of concurrent -sessions per user add the following line in /etc/security/limits.conf or -a file under /etc/security/limits.d/: -* hard maxlogins - 14 - 15 - 18 - 9 - 5.5.2.2 - DSS01.05 - DSS05.02 - CCI-000054 - 4.3.3.4 - SR 3.1 - SR 3.8 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.14.1.2 - A.14.1.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - AC-10 - CM-6(a) - PR.AC-5 - SRG-OS-000027-GPOS-00008 - SRG-OS-000027-VMM-000080 - Limiting simultaneous user logins can insulate the system from denial of service -problems caused by excessive logins. Automated login processes operating improperly or -maliciously may result in an exceptional number of simultaneous login sessions. - - - - - - - - - - - Configure Polyinstantiation of /tmp Directories - To configure polyinstantiated /tmp directories, first create the parent directories -which will hold the polyinstantiation child directories. Use the following command: -$ sudo mkdir --mode 000 /tmp/tmp-inst -Then, add the following entry to /etc/security/namespace.conf: -/tmp /tmp/tmp-inst/ level root,adm - BP28(R39) - Polyinstantiation of temporary directories is a proactive security measure -which reduces chances of attacks that are made possible by /tmp -directories being world-writable. - - - - - - - - - Configure Polyinstantiation of /var/tmp Directories - To configure polyinstantiated /tmp directories, first create the parent directories -which will hold the polyinstantiation child directories. Use the following command: -$ sudo mkdir --mode 000 /var/tmp/tmp-inst -Then, add the following entry to /etc/security/namespace.conf: -/var/tmp /var/tmp/tmp-inst/ level root,adm - BP28(R39) - Polyinstantiation of temporary directories is a proactive security measure -which reduces chances of attacks that are made possible by /var/tmp -directories being world-writable. - - - - - - - - - Set Interactive Session Timeout - Setting the TMOUT option in /etc/profile ensures that -all user sessions will terminate based on inactivity. -The value of TMOUT should be exported and read only. -The TMOUT - -setting in a file loaded by /etc/profile, e.g. -/etc/profile.d/tmout.sh should read as follows: -declare -xr TMOUT= - BP28(R29) - 1 - 12 - 15 - 16 - DSS05.04 - DSS05.10 - DSS06.10 - 3.1.11 - CCI-000057 - CCI-001133 - CCI-002361 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.4 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CIP-004-6 R2.2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-12 - SC-10 - AC-2(5) - CM-6(a) - PR.AC-7 - FMT_MOF_EXT.1 - SRG-OS-000163-GPOS-00072 - SRG-OS-000029-GPOS-00010 - SRG-OS-000163-VMM-000700 - SRG-OS-000279-VMM-001010 - Terminating an idle session within a short time period reduces -the window of opportunity for unauthorized personnel to take control of a -management session enabled on the console or console port that has been -left unattended. - - - - - - - - - - - Ensure that User Home Directories are not Group-Writable or World-Readable - For each human user of the system, view the -permissions of the user's home directory: -# ls -ld /home/USER -Ensure that the directory is not group-writable and that it -is not world-readable. If necessary, repair the permissions: -# chmod g-w /home/USER -# chmod o-rwx /home/USER - This action may involve modifying user home directories. -Notify your user community, and solicit input if appropriate, -before making this type of change. - This rule is deprecated in favor of the file_permissions_home_directories rule. -Please consider replacing this rule in your files as it is not expected to receive -updates as of version 0.1.62. - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-000225 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - CM-6(a) - PR.AC-4 - PR.DS-5 - User home directories contain many configuration files which -affect the behavior of a user's account. No user should ever have -write permission to another user's home directory. Group shared -directories can be configured in sub-directories or elsewhere in the -filesystem if they are needed. Typically, user home directories -should not be world-readable, as it would disclose file names -to other users. If a subset of users need read access -to one another's home directories, this can be provided using -groups or ACLs. - - - - - - - - - Ensure that No Dangerous Directories Exist in Root's Path - The active path of the root account can be obtained by -starting a new root shell and running: -# echo $PATH -This will produce a colon-separated list of -directories in the path. - -Certain path elements could be considered dangerous, as they could lead -to root executing unknown or -untrusted programs, which could contain malicious -code. -Since root may sometimes work inside -untrusted directories, the . character, which represents the -current directory, should never be in the root path, nor should any -directory which can be written to by an unprivileged or -semi-privileged (system) user. - -It is a good practice for administrators to always execute -privileged commands by typing the full path to the -command. - - Ensure that Root's Path Does Not Include World or Group-Writable Directories - For each element in root's path, run: -# ls -ld DIR -and ensure that write permissions are disabled for group and -other. - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - CCI-000366 - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - CM-6(a) - CM-6(a) - PR.IP-1 - Such entries increase the risk that root could -execute code provided by unprivileged users, -and potentially malicious code. - - - - - - - - - Ensure that Root's Path Does Not Include Relative Paths or Null Directories - Ensure that none of the directories in root's path is equal to a single -. character, or -that it contains any instances that lead to relative path traversal, such as -.. or beginning a path without the slash (/) character. -Also ensure that there are no "empty" elements in the path, such as in these examples: -PATH=:/bin -PATH=/bin: -PATH=/bin::/sbin -These empty elements have the same effect as a single . character. - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - CCI-000366 - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - CM-6(a) - CM-6(a) - PR.IP-1 - Including these entries increases the risk that root could -execute code from an untrusted location. - - - - - - - Ensure that Users Have Sensible Umask Values - The umask setting controls the default permissions -for the creation of new files. -With a default umask setting of 077, files and directories -created by users will not be readable by any other user on the -system. Users who wish to make specific files group- or -world-readable can accomplish this by using the chmod command. -Additionally, users can make all their files readable to their -group by default by setting a umask of 027 in their shell -configuration files. If default per-user groups exist (that is, if -every user has a default group whose name is the same as that -user's username and whose only member is the user), then it may -even be safe for users to select a umask of 007, making it very -easy to intentionally share files with groups of which the user is -a member. - - - Sensible umask - Enter default user umask - 007 - 022 - 027 - 077 - 027 - - - Ensure the Default Bash Umask is Set Correctly - To ensure the default umask for users of the Bash shell is set properly, -add or correct the umask setting in /etc/bashrc to read -as follows: -umask - BP28(R35) - 18 - APO13.01 - BAI03.01 - BAI03.02 - BAI03.03 - CCI-000366 - 4.3.4.3.3 - A.14.1.1 - A.14.2.1 - A.14.2.5 - A.6.1.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6(1) - CM-6(a) - PR.IP-2 - SRG-OS-000480-GPOS-00228 - SRG-OS-000480-GPOS-00227 - The umask value influences the permissions assigned to files when they are created. -A misconfigured umask value could result in files with excessive permissions that can be read or -written to by unauthorized users. - CCE-84260-9 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%20/etc/bashrc%0A%0A%23%20System%20wide%20functions%20and%20aliases%0A%23%20Environment%20stuff%20goes%20in%20/etc/profile%0A%0A%23%20It%27s%20NOT%20a%20good%20idea%20to%20change%20this%20file%20unless%20you%20know%20what%20you%0A%23%20are%20doing.%20It%27s%20much%20better%20to%20create%20a%20custom.sh%20shell%20script%20in%0A%23%20/etc/profile.d/%20to%20make%20custom%20changes%20to%20your%20environment%2C%20as%20this%0A%23%20will%20prevent%20the%20need%20for%20merging%20in%20future%20updates.%0A%0A%23%20Prevent%20doublesourcing%0Aif%20%5B%20-z%20%22%24BASHRCSOURCED%22%20%5D%3B%20then%0A%20%20BASHRCSOURCED%3D%22Y%22%0A%0A%20%20%23%20are%20we%20an%20interactive%20shell%3F%0A%20%20if%20%5B%20%22%24PS1%22%20%5D%3B%20then%0A%20%20%20%20if%20%5B%20-z%20%22%24PROMPT_COMMAND%22%20%5D%3B%20then%0A%20%20%20%20%20%20case%20%24TERM%20in%0A%20%20%20%20%20%20xterm%2A%7Cvte%2A%29%0A%20%20%20%20%20%20%20%20if%20%5B%20-e%20/etc/sysconfig/bash-prompt-xterm%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20PROMPT_COMMAND%3D/etc/sysconfig/bash-prompt-xterm%0A%20%20%20%20%20%20%20%20elif%20%5B%20%22%24%7BVTE_VERSION%3A-0%7D%22%20-ge%203405%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20PROMPT_COMMAND%3D%22__vte_prompt_command%22%0A%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20PROMPT_COMMAND%3D%27printf%20%22%5C033%5D0%3B%25s%40%25s%3A%25s%5C007%22%20%22%24%7BUSER%7D%22%20%22%24%7BHOSTNAME%25%25.%2A%7D%22%20%22%24%7BPWD/%23%24HOME/%5C~%7D%22%27%0A%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20%3B%3B%0A%20%20%20%20%20%20screen%2A%29%0A%20%20%20%20%20%20%20%20if%20%5B%20-e%20/etc/sysconfig/bash-prompt-screen%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20PROMPT_COMMAND%3D/etc/sysconfig/bash-prompt-screen%0A%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20PROMPT_COMMAND%3D%27printf%20%22%5C033k%25s%40%25s%3A%25s%5C033%5C%5C%22%20%22%24%7BUSER%7D%22%20%22%24%7BHOSTNAME%25%25.%2A%7D%22%20%22%24%7BPWD/%23%24HOME/%5C~%7D%22%27%0A%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20%3B%3B%0A%20%20%20%20%20%20%2A%29%0A%20%20%20%20%20%20%20%20%5B%20-e%20/etc/sysconfig/bash-prompt-default%20%5D%20%26%26%20PROMPT_COMMAND%3D/etc/sysconfig/bash-prompt-default%0A%20%20%20%20%20%20%20%20%3B%3B%0A%20%20%20%20%20%20esac%0A%20%20%20%20fi%0A%20%20%20%20%23%20Turn%20on%20parallel%20history%0A%20%20%20%20shopt%20-s%20histappend%0A%20%20%20%20history%20-a%0A%20%20%20%20%23%20Turn%20on%20checkwinsize%0A%20%20%20%20shopt%20-s%20checkwinsize%0A%20%20%20%20%5B%20%22%24PS1%22%20%3D%20%22%5C%5Cs-%5C%5Cv%5C%5C%5C%24%20%22%20%5D%20%26%26%20PS1%3D%22%5B%5Cu%40%5Ch%20%5CW%5D%5C%5C%24%20%22%0A%20%20%20%20%23%20You%20might%20want%20to%20have%20e.g.%20tty%20in%20prompt%20%28e.g.%20more%20virtual%20machines%29%0A%20%20%20%20%23%20and%20console%20windows%0A%20%20%20%20%23%20If%20you%20want%20to%20do%20so%2C%20just%20add%20e.g.%0A%20%20%20%20%23%20if%20%5B%20%22%24PS1%22%20%5D%3B%20then%0A%20%20%20%20%23%20%20%20PS1%3D%22%5B%5Cu%40%5Ch%3A%5Cl%20%5CW%5D%5C%5C%24%20%22%0A%20%20%20%20%23%20fi%0A%20%20%20%20%23%20to%20your%20custom%20modification%20shell%20script%20in%20/etc/profile.d/%20directory%0A%20%20fi%0A%0A%20%20if%20%21%20shopt%20-q%20login_shell%20%3B%20then%20%23%20We%27re%20not%20a%20login%20shell%0A%20%20%20%20%23%20Need%20to%20redefine%20pathmunge%2C%20it%20gets%20undefined%20at%20the%20end%20of%20/etc/profile%0A%20%20%20%20pathmunge%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20case%20%22%3A%24%7BPATH%7D%3A%22%20in%0A%20%20%20%20%20%20%20%20%20%20%20%20%2A%3A%22%241%22%3A%2A%29%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3B%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%2A%29%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20%5B%20%22%242%22%20%3D%20%22after%22%20%5D%20%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20PATH%3D%24PATH%3A%241%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20PATH%3D%241%3A%24PATH%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20esac%0A%20%20%20%20%7D%0A%0A%20%20%20%20%23%20By%20default%2C%20we%20want%20umask%20to%20get%20set.%20This%20sets%20it%20for%20non-login%20shell.%0A%20%20%20%20%23%20Current%20threshold%20for%20system%20reserved%20uid/gids%20is%20200%0A%20%20%20%20%23%20You%20could%20check%20uidgid%20reservation%20validity%20in%0A%20%20%20%20%23%20/usr/share/doc/setup-%2A/uidgid%20file%0A%20%20%20%20if%20%5B%20%24UID%20-gt%20199%20%5D%20%26%26%20%5B%20%22%60id%20-gn%60%22%20%3D%20%22%60id%20-un%60%22%20%5D%3B%20then%0A%20%20%20%20%20%20%20umask%20027%0A%20%20%20%20else%0A%20%20%20%20%20%20%20umask%20027%0A%20%20%20%20fi%0A%0A%20%20%20%20SHELL%3D/bin/bash%0A%20%20%20%20%23%20Only%20display%20echos%20from%20profile.d%20scripts%20if%20we%20are%20no%20login%20shell%0A%20%20%20%20%23%20and%20interactive%20-%20otherwise%20just%20process%20them%20to%20set%20envvars%0A%20%20%20%20for%20i%20in%20/etc/profile.d/%2A.sh%3B%20do%0A%20%20%20%20%20%20%20%20if%20%5B%20-r%20%22%24i%22%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20if%20%5B%20%22%24PS1%22%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.%20%22%24i%22%0A%20%20%20%20%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.%20%22%24i%22%20%3E/dev/null%0A%20%20%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20fi%0A%20%20%20%20done%0A%0A%20%20%20%20unset%20i%0A%20%20%20%20unset%20-f%20pathmunge%0A%20%20fi%0A%0Afi%0A%23%20vim%3Ats%3D4%3Asw%3D4%0A%0A%0A - mode: 0644 - path: /etc/bashrc - overwrite: true - - - - - - - - - - - Ensure the Default C Shell Umask is Set Correctly - To ensure the default umask for users of the C shell is set properly, -add or correct the umask setting in /etc/csh.cshrc to read as follows: -umask - 18 - APO13.01 - BAI03.01 - BAI03.02 - BAI03.03 - CCI-000366 - 4.3.4.3.3 - A.14.1.1 - A.14.2.1 - A.14.2.5 - A.6.1.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6(1) - CM-6(a) - PR.IP-2 - SRG-OS-000480-GPOS-00228 - SRG-OS-000480-GPOS-00227 - The umask value influences the permissions assigned to files when they are created. -A misconfigured umask value could result in files with excessive permissions that can be read or -written to by unauthorized users. - CCE-84261-7 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%20/etc/cshrc%0A%23%0A%23%20csh%20configuration%20for%20all%20shell%20invocations.%0A%0A%23%20By%20default%2C%20we%20want%20this%20to%20get%20set.%0A%23%20Even%20for%20non-interactive%2C%20non-login%20shells.%0A%23%20Current%20threshold%20for%20system%20reserved%20uid/gids%20is%20200%0A%23%20You%20could%20check%20uidgid%20reservation%20validity%20in%0A%23%20/usr/share/doc/setup-%2A/uidgid%20file%0Aif%20%28%24uid%20%3E%20199%20%26%26%20%22%60id%20-gn%60%22%20%3D%3D%20%22%60id%20-un%60%22%29%20then%0A%20%20%20%20umask%20027%0Aelse%0A%20%20%20%20umask%20027%0Aendif%0A%0Aif%20%28%24%3Fprompt%29%20then%0A%20%20if%20%28%24%3Ftcsh%29%20then%0A%20%20%20%20set%20promptchars%3D%27%24%23%27%0A%20%20%20%20set%20prompt%3D%27%5B%25n%40%25m%20%25c%5D%25%23%20%27%0A%20%20%20%20%23%20make%20completion%20work%20better%20by%20default%0A%20%20%20%20set%20autolist%0A%20%20else%0A%20%20%20%20set%20prompt%3D%5C%5B%24user%40%60hostname%20-s%60%5C%5D%5C%24%5C%20%0A%20%20endif%0Aendif%0A%0Aif%20%28%20%24%3Ftcsh%20%29%20then%0A%09bindkey%20%22%5E%5B%5B3~%22%20delete-char%0Aendif%0A%0Abindkey%20%22%5ER%22%20i-search-back%0Aset%20echo_style%20%3D%20both%0Aset%20histdup%20%3D%20erase%0Aset%20savehist%20%3D%20%281024%20merge%29%0A%0Aif%20%28%24%3Fprompt%29%20then%0A%20%20if%20%28%24%3FTERM%29%20then%0A%20%20%20%20switch%28%24TERM%29%0A%20%20%20%20%20%20case%20xterm%2A%3A%0A%20%20%20%20%20%20%20%20if%20%28%24%3Ftcsh%29%20then%0A%09%20%20set%20prompt%3D%27%25%7B%5C033%5D0%3B%25n%40%25m%3A%25c%5C007%25%7D%5B%25n%40%25m%20%25c%5D%25%23%20%27%0A%20%20%20%20%20%20%20%20endif%0A%20%20%20%20%20%20%20%20breaksw%0A%20%20%20%20%20%20case%20screen%3A%0A%20%20%20%20%20%20%20%20if%20%28%24%3Ftcsh%29%20then%0A%20%20%20%20%20%20%20%20%20%20set%20prompt%3D%27%25%7B%5C033k%25n%40%25m%3A%25c%5C033%5C%5C%25%7D%5B%25n%40%25m%20%25c%5D%25%23%20%27%0A%20%20%20%20%20%20%20%20endif%0A%20%20%20%20%20%20%20%20breaksw%0A%20%20%20%20%20%20default%3A%0A%20%20%20%20%20%20%20%20breaksw%0A%20%20%20%20endsw%0A%20%20endif%0Aendif%0A%0Asetenv%20MAIL%20%22/var/spool/mail/%24USER%22%0A%0A%23%20Check%20if%20we%20aren%27t%20a%20loginshell%20and%20do%20stuff%20if%20we%20aren%27t%0Aif%20%28%21%20%24%3Floginsh%29%20then%0A%20%20%20%20if%20%28%20-d%20/etc/profile.d%20%29%20then%0A%20%20%20%20%20%20%20%20set%20nonomatch%0A%20%20%20%20%20%20%20%20foreach%20i%20%28%20/etc/profile.d/%2A.csh%20%29%0A%20%20%20%20%20%20%20%20%20%20%20%20if%20%28%20-r%20%22%24i%22%20%29%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20%28%24%3Fprompt%29%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20source%20%22%24i%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20source%20%22%24i%22%20%3E%26/dev/null%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20endif%0A%20%20%20%20%20%20%20%20%20%20%20%20endif%0A%20%20%20%20%20%20%20%20end%0A%20%20%20%20%20%20%20%20unset%20i%20nonomatch%0A%20%20%20%20endif%0Aendif%0A%0A%0A - mode: 0644 - path: /etc/csh.cshrc - overwrite: true - - - - - - - - - - - Ensure the Default Umask is Set Correctly in login.defs - To ensure the default umask controlled by /etc/login.defs is set properly, -add or correct the UMASK setting in /etc/login.defs to read as follows: -UMASK - BP28(R35) - 11 - 18 - 3 - 9 - APO13.01 - BAI03.01 - BAI03.02 - BAI03.03 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - CCI-000366 - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.1.1 - A.14.2.1 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.14.2.5 - A.6.1.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6(1) - CM-6(a) - PR.IP-1 - PR.IP-2 - SRG-OS-000480-GPOS-00228 - The umask value influences the permissions assigned to files when they are created. -A misconfigured umask value could result in files with excessive permissions that can be read and -written to by unauthorized users. - - - - - - - - - - - Ensure the Default Umask is Set Correctly in /etc/profile - To ensure the default umask controlled by /etc/profile is set properly, -add or correct the umask setting in /etc/profile to read as follows: -umask - BP28(R35) - 18 - APO13.01 - BAI03.01 - BAI03.02 - BAI03.03 - CCI-000366 - 4.3.4.3.3 - A.14.1.1 - A.14.2.1 - A.14.2.5 - A.6.1.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6(1) - CM-6(a) - PR.IP-2 - SRG-OS-000480-GPOS-00228 - SRG-OS-000480-GPOS-00227 - The umask value influences the permissions assigned to files when they are created. -A misconfigured umask value could result in files with excessive permissions that can be read or -written to by unauthorized users. - CCE-84262-5 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%20/etc/profile%0A%0A%23%20System%20wide%20environment%20and%20startup%20programs%2C%20for%20login%20setup%0A%23%20Functions%20and%20aliases%20go%20in%20/etc/bashrc%0A%0A%23%20It%27s%20NOT%20a%20good%20idea%20to%20change%20this%20file%20unless%20you%20know%20what%20you%0A%23%20are%20doing.%20It%27s%20much%20better%20to%20create%20a%20custom.sh%20shell%20script%20in%0A%23%20/etc/profile.d/%20to%20make%20custom%20changes%20to%20your%20environment%2C%20as%20this%0A%23%20will%20prevent%20the%20need%20for%20merging%20in%20future%20updates.%0A%0Apathmunge%20%28%29%20%7B%0A%20%20%20%20case%20%22%3A%24%7BPATH%7D%3A%22%20in%0A%20%20%20%20%20%20%20%20%2A%3A%22%241%22%3A%2A%29%0A%20%20%20%20%20%20%20%20%20%20%20%20%3B%3B%0A%20%20%20%20%20%20%20%20%2A%29%0A%20%20%20%20%20%20%20%20%20%20%20%20if%20%5B%20%22%242%22%20%3D%20%22after%22%20%5D%20%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20PATH%3D%24PATH%3A%241%0A%20%20%20%20%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20PATH%3D%241%3A%24PATH%0A%20%20%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20esac%0A%7D%0A%0A%0Aif%20%5B%20-x%20/usr/bin/id%20%5D%3B%20then%0A%20%20%20%20if%20%5B%20-z%20%22%24EUID%22%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%23%20ksh%20workaround%0A%20%20%20%20%20%20%20%20EUID%3D%60id%20-u%60%0A%20%20%20%20%20%20%20%20UID%3D%60id%20-ru%60%0A%20%20%20%20fi%0A%20%20%20%20USER%3D%22%60id%20-un%60%22%0A%20%20%20%20LOGNAME%3D%24USER%0A%20%20%20%20MAIL%3D%22/var/spool/mail/%24USER%22%0Afi%0A%0A%23%20Path%20manipulation%0Aif%20%5B%20%22%24EUID%22%20%3D%20%220%22%20%5D%3B%20then%0A%20%20%20%20pathmunge%20/usr/sbin%0A%20%20%20%20pathmunge%20/usr/local/sbin%0Aelse%0A%20%20%20%20pathmunge%20/usr/local/sbin%20after%0A%20%20%20%20pathmunge%20/usr/sbin%20after%0Afi%0A%0AHOSTNAME%3D%60/usr/bin/hostname%202%3E/dev/null%60%0AHISTSIZE%3D1000%0Aif%20%5B%20%22%24HISTCONTROL%22%20%3D%20%22ignorespace%22%20%5D%20%3B%20then%0A%20%20%20%20export%20HISTCONTROL%3Dignoreboth%0Aelse%0A%20%20%20%20export%20HISTCONTROL%3Dignoredups%0Afi%0A%0Aexport%20PATH%20USER%20LOGNAME%20MAIL%20HOSTNAME%20HISTSIZE%20HISTCONTROL%0A%0A%23%20By%20default%2C%20we%20want%20umask%20to%20get%20set.%20This%20sets%20it%20for%20login%20shell%0A%23%20Current%20threshold%20for%20system%20reserved%20uid/gids%20is%20200%0A%23%20You%20could%20check%20uidgid%20reservation%20validity%20in%0A%23%20/usr/share/doc/setup-%2A/uidgid%20file%0Aif%20%5B%20%24UID%20-gt%20199%20%5D%20%26%26%20%5B%20%22%60id%20-gn%60%22%20%3D%20%22%60id%20-un%60%22%20%5D%3B%20then%0A%20%20%20%20umask%20027%0Aelse%0A%20%20%20%20umask%20027%0Afi%0A%0Afor%20i%20in%20/etc/profile.d/%2A.sh%20/etc/profile.d/sh.local%20%3B%20do%0A%20%20%20%20if%20%5B%20-r%20%22%24i%22%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20if%20%5B%20%22%24%7B-%23%2Ai%7D%22%20%21%3D%20%22%24-%22%20%5D%3B%20then%20%0A%20%20%20%20%20%20%20%20%20%20%20%20.%20%22%24i%22%0A%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20.%20%22%24i%22%20%3E/dev/null%0A%20%20%20%20%20%20%20%20fi%0A%20%20%20%20fi%0Adone%0A%0Aunset%20i%0Aunset%20-f%20pathmunge%0A%0Aif%20%5B%20-n%20%22%24%7BBASH_VERSION-%7D%22%20%5D%20%3B%20then%0A%20%20%20%20%20%20%20%20if%20%5B%20-f%20/etc/bashrc%20%5D%20%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%23%20Bash%20login%20shells%20run%20only%20/etc/profile%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%23%20Bash%20non-login%20shells%20run%20only%20/etc/bashrc%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%23%20Check%20for%20double%20sourcing%20is%20done%20in%20/etc/bashrc.%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.%20/etc/bashrc%0A%20%20%20%20%20%20%20fi%0Afi%0A%0A%0A - mode: 0644 - path: /etc/profile - overwrite: true - - - - - - - - - - - - - - System Accounting with auditd - The audit service provides substantial capabilities -for recording system activities. By default, the service audits about -SELinux AVC denials and certain types of security-relevant events -such as system logins, account modifications, and authentication -events performed by programs such as sudo. -Under its default configuration, auditd has modest disk space -requirements, and should not noticeably impact system performance. - -NOTE: The Linux Audit daemon auditd can be configured to use -the augenrules program to read audit rules files (*.rules) -located in /etc/audit/rules.d location and compile them to create -the resulting form of the /etc/audit/audit.rules configuration file -during the daemon startup (default configuration). Alternatively, the auditd -daemon can use the auditctl utility to read audit rules from the -/etc/audit/audit.rules configuration file during daemon startup, -and load them into the kernel. The expected behavior is configured via the -appropriate ExecStartPost directive setting in the -/usr/lib/systemd/system/auditd.service configuration file. -To instruct the auditd daemon to use the augenrules program -to read audit rules (default configuration), use the following setting: - ExecStartPost=-/sbin/augenrules --load -in the /usr/lib/systemd/system/auditd.service configuration file. -In order to instruct the auditd daemon to use the auditctl -utility to read audit rules, use the following setting: - ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules -in the /usr/lib/systemd/system/auditd.service configuration file. -Refer to [Service] section of the /usr/lib/systemd/system/auditd.service -configuration file for further details. - -Government networks often have substantial auditing -requirements and auditd can be configured to meet these -requirements. -Examining some example audit records demonstrates how the Linux audit system -satisfies common requirements. -The following example from Red Hat Enterprise Linux 7 Documentation available at -https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages -shows the substantial amount of information captured in a -two typical "raw" audit messages, followed by a breakdown of the most important -fields. In this example the message is SELinux-related and reports an AVC -denial (and the associated system call) that occurred when the Apache HTTP -Server attempted to access the /var/www/html/file1 file (labeled with -the samba_share_t type): -type=AVC msg=audit(1226874073.147:96): avc: denied { getattr } for pid=2465 comm="httpd" -path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 -tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file - -type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13 -a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48 -gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd" -exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null) - -msg=audit(1226874073.147:96)The number in parentheses is the unformatted time stamp (Epoch time) -for the event, which can be converted to standard time by using the -date command. -{ getattr }The item in braces indicates the permission that was denied. getattr -indicates the source process was trying to read the target file's status information. -This occurs before reading files. This action is denied due to the file being -accessed having the wrong label. Commonly seen permissions include getattr, -read, and write.comm="httpd"The executable that launched the process. The full path of the executable is -found in the exe= section of the system call (SYSCALL) message, -which in this case, is exe="/usr/sbin/httpd". -path="/var/www/html/file1"The path to the object (target) the process attempted to access. -scontext="unconfined_u:system_r:httpd_t:s0"The SELinux context of the process that attempted the denied action. In -this case, it is the SELinux context of the Apache HTTP Server, which is running -in the httpd_t domain. -tcontext="unconfined_u:object_r:samba_share_t:s0"The SELinux context of the object (target) the process attempted to access. -In this case, it is the SELinux context of file1. Note: the samba_share_t -type is not accessible to processes running in the httpd_t domain. From the system call (SYSCALL) message, two items are of interest: -success=no: indicates whether the denial (AVC) was enforced or not. -success=no indicates the system call was not successful (SELinux denied -access). success=yes indicates the system call was successful - this can -be seen for permissive domains or unconfined domains, such as initrc_t -and kernel_t. -exe="/usr/sbin/httpd": the full path to the executable that launched -the process, which in this case, is exe="/usr/sbin/httpd". - - - - - Install audispd-plugins Package - The audispd-plugins package can be installed with the following command: - - FMT_SMF_EXT.1 - SRG-OS-000342-GPOS-00133 - audispd-plugins provides plugins for the real-time interface to the -audit subsystem, audispd. These plugins can do things like relay events -to remote machines or analyze events for suspicious behavior. - - - - - - - - - - Ensure the default plugins for the audit dispatcher are Installed - The audit-audispd-plugins package should be installed. - CCI-001851 - SRG-OS-000342-GPOS-00133 - Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. - - - - - - - - - - Ensure the audit Subsystem is Installed - The audit package should be installed. - BP28(R50) - CCI-000130 - CCI-000131 - CCI-000132 - CCI-000133 - CCI-000134 - CCI-000135 - CCI-000154 - CCI-000158 - CCI-000172 - CCI-001464 - CCI-001487 - CCI-001814 - CCI-001875 - CCI-001876 - CCI-001877 - CCI-001878 - CCI-001879 - CCI-001880 - CCI-001881 - CCI-001882 - CCI-001889 - CCI-001914 - CCI-002884 - CCI-000169 - CIP-004-6 R3.3 - CIP-007-3 R6.5 - AC-7(a) - AU-7(1) - AU-7(2) - AU-14 - AU-12(2) - AU-2(a) - CM-6(a) - FAU_GEN.1 - SRG-OS-000062-GPOS-00031 - SRG-OS-000037-GPOS-00015 - SRG-OS-000038-GPOS-00016 - SRG-OS-000039-GPOS-00017 - SRG-OS-000040-GPOS-00018 - SRG-OS-000041-GPOS-00019 - SRG-OS-000042-GPOS-00021 - SRG-OS-000051-GPOS-00024 - SRG-OS-000054-GPOS-00025 - SRG-OS-000122-GPOS-00063 - SRG-OS-000254-GPOS-00095 - SRG-OS-000255-GPOS-00096 - SRG-OS-000337-GPOS-00129 - SRG-OS-000348-GPOS-00136 - SRG-OS-000349-GPOS-00137 - SRG-OS-000350-GPOS-00138 - SRG-OS-000351-GPOS-00139 - SRG-OS-000352-GPOS-00140 - SRG-OS-000353-GPOS-00141 - SRG-OS-000354-GPOS-00142 - SRG-OS-000358-GPOS-00145 - SRG-OS-000365-GPOS-00152 - SRG-OS-000392-GPOS-00172 - SRG-OS-000475-GPOS-00220 - The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy. - - CCE-82669-3 - - - - - - - - - Enable auditd Service - The auditd service is an essential userspace component of -the Linux Auditing System, as it is responsible for writing audit records to -disk. - -The auditd service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-auditd-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: auditd.service - enabled: true - - -This will enable the auditd service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.3.1 - 3.3.2 - 3.3.6 - CCI-000126 - CCI-000130 - CCI-000131 - CCI-000132 - CCI-000133 - CCI-000134 - CCI-000135 - CCI-000154 - CCI-000158 - CCI-000172 - CCI-000366 - CCI-001464 - CCI-001487 - CCI-001814 - CCI-001875 - CCI-001876 - CCI-001877 - CCI-002884 - CCI-001878 - CCI-001879 - CCI-001880 - CCI-001881 - CCI-001882 - CCI-001889 - CCI-001914 - CCI-000169 - 164.308(a)(1)(ii)(D) - 164.308(a)(5)(ii)(C) - 164.310(a)(2)(iv) - 164.310(d)(2)(iii) - 164.312(b) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - CIP-004-6 R3.3 - CIP-007-3 R6.5 - AC-2(g) - AU-3 - AU-10 - AU-2(d) - AU-12(c) - AU-14(1) - AC-6(9) - CM-6(a) - SI-4(23) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1 - Req-10.1 - SRG-OS-000062-GPOS-00031 - SRG-OS-000037-GPOS-00015 - SRG-OS-000038-GPOS-00016 - SRG-OS-000039-GPOS-00017 - SRG-OS-000040-GPOS-00018 - SRG-OS-000041-GPOS-00019 - SRG-OS-000042-GPOS-00021 - SRG-OS-000051-GPOS-00024 - SRG-OS-000054-GPOS-00025 - SRG-OS-000122-GPOS-00063 - SRG-OS-000254-GPOS-00095 - SRG-OS-000255-GPOS-00096 - SRG-OS-000337-GPOS-00129 - SRG-OS-000348-GPOS-00136 - SRG-OS-000349-GPOS-00137 - SRG-OS-000350-GPOS-00138 - SRG-OS-000351-GPOS-00139 - SRG-OS-000352-GPOS-00140 - SRG-OS-000353-GPOS-00141 - SRG-OS-000354-GPOS-00142 - SRG-OS-000358-GPOS-00145 - SRG-OS-000365-GPOS-00152 - SRG-OS-000392-GPOS-00172 - SRG-OS-000475-GPOS-00220 - SRG-OS-000037-VMM-000150 - SRG-OS-000063-VMM-000310 - SRG-OS-000038-VMM-000160 - SRG-OS-000039-VMM-000170 - SRG-OS-000040-VMM-000180 - SRG-OS-000041-VMM-000190 - Without establishing what type of events occurred, it would be difficult -to establish, correlate, and investigate the events leading up to an outage or attack. -Ensuring the auditd service is active ensures audit records -generated by the kernel are appropriately recorded. - -Additionally, a properly configured audit subsystem ensures that actions of -individual system users can be uniquely traced to those users so they -can be held accountable for their actions. - - - CCE-82463-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: auditd.service - enabled: true - - - - - - - - - - Extend Audit Backlog Limit for the Audit Daemon - To improve the kernel capacity to queue all log events, even those which occurred -prior to the audit daemon, add the argument audit_backlog_limit=8192 to all -BLS (Boot Loader Specification) entries ('options' line) for the Linux -operating system in /boot/loader/entries/*.conf. - CM-6(a) - SRG-OS-000254-GPOS-00095 - audit_backlog_limit sets the queue length for audit events awaiting transfer -to the audit daemon. Until the audit daemon is up and running, all log messages -are stored in this queue. If the queue is overrun during boot process, the action -defined by audit failure flag is taken. - - CCE-82671-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - kernelArguments: - - audit_backlog_limit=8192 - - - - - - - - - - Enable Auditing for Processes Which Start Prior to the Audit Daemon - To ensure all processes can be audited, even those which start -prior to the audit daemon, add the argument audit=1 to all -BLS (Boot Loader Specification) entries ('options' line) for the Linux -operating system in /boot/loader/entries/*.conf. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.3.1 - CCI-001464 - CCI-000130 - 164.308(a)(1)(ii)(D) - 164.308(a)(5)(ii)(C) - 164.310(a)(2)(iv) - 164.310(d)(2)(iii) - 164.312(b) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - CIP-004-6 R3.3 - CIP-007-3 R7.1 - AC-17(1) - AU-14(1) - AU-10 - CM-6(a) - IR-5(1) - DE.AE-3 - DE.AE-5 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.3 - SRG-OS-000254-GPOS-00095 - SRG-OS-000254-VMM-000880 - Each process on the system carries an "auditable" flag which indicates whether -its activities can be audited. Although auditd takes care of enabling -this for all processes which launch after it does, adding the kernel argument -ensures it is set for every process during boot. - - CCE-82670-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - kernelArguments: - - audit=1 - - - - - - - - - - Configure auditd Rules for Comprehensive Auditing - The auditd program can perform comprehensive -monitoring of system activity. This section describes recommended -configuration settings for comprehensive auditing, but a full -description of the auditing system's capabilities is beyond the -scope of this guide. The mailing list linux-audit@redhat.com exists -to facilitate community discussion of the auditing system. - -The audit subsystem supports extensive collection of events, including: - -Tracing of arbitrary system calls (identified by name or number) -on entry or exit.Filtering by PID, UID, call success, system call argument (with -some limitations), etc.Monitoring of specific files for modifications to the file's -contents or metadata. - -Auditing rules at startup are controlled by the file /etc/audit/audit.rules. -Add rules to it to meet the auditing requirements for your organization. -Each line in /etc/audit/audit.rules represents a series of arguments -that can be passed to auditctl and can be individually tested -during runtime. See documentation in /usr/share/doc/audit-VERSION and -in the related man pages for more details. - -If copying any example audit rulesets from /usr/share/doc/audit-VERSION, -be sure to comment out the -lines containing arch= which are not appropriate for your system's -architecture. Then review and understand the following rules, -ensuring rules are activated as needed for the appropriate -architecture. - -After reviewing all the rules, reading the following sections, and -editing as needed, the new rules can be activated as follows: -$ sudo service auditd restart - - - Record Events that Modify User/Group Information via open syscall - /etc/group - The audit system should collect write events to /etc/group file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82700-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/group%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/group%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_group_open_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group - The audit system should collect write events to /etc/group file for all group and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82702-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/group%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/group%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_group_open_by_handle_at_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/group - The audit system should collect write events to /etc/group file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82701-4 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/group%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/group%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_group_openat_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via open syscall - /etc/gshadow - The audit system should collect write events to /etc/gshadow file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82703-0 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/gshadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/gshadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_gshadow_open_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow - The audit system should collect write events to /etc/gshadow file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82705-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/gshadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/gshadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_gshadow_open_by_handle_at_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/gshadow - The audit system should collect write events to /etc/gshadow file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82704-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/gshadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/gshadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_gshadow_openat_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via open syscall - /etc/passwd - The audit system should collect write events to /etc/passwd file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82706-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_passwd_open_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd - The audit system should collect write events to /etc/passwd file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82708-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_passwd_open_by_handle_at_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/passwd - The audit system should collect write events to /etc/passwd file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82707-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_passwd_openat_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via open syscall - /etc/shadow - The audit system should collect write events to /etc/shadow file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82709-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_shadow_open_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow - The audit system should collect write events to /etc/shadow file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82711-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_shadow_open_by_handle_at_path_syscall.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/shadow - The audit system should collect write events to /etc/shadow file for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise. - - CCE-82710-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%20-F%20a2%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dmodify%0A - mode: 0644 - path: /etc/audit/rules.d/75-etc_shadow_openat_path_syscall.rules - overwrite: true - - - - - - - - - - Make the auditd Configuration Immutable - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d in order to make the auditd configuration -immutable: --e 2 -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file in order to make the auditd configuration -immutable: --e 2 -With this setting, a reboot will be required to change any audit rules. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.3.1 - 3.4.3 - CCI-000162 - CCI-000163 - CCI-000164 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.310(a)(2)(iv) - 164.312(d) - 164.310(d)(2)(iii) - 164.312(b) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - ID.SC-4 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.2 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - Making the audit configuration immutable prevents accidental as -well as malicious modification of the audit rules, although it may be -problematic if legitimate changes are needed during system -operation. - - CCE-82668-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-e%202%0A - mode: 0600 - path: /etc/audit/rules.d/90-immutable.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Mandatory Access Controls - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d: --w /etc/selinux/ -p wa -k MAC-policy -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --w /etc/selinux/ -p wa -k MAC-policy - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.8 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - The system's mandatory access policy (SELinux) should not be -arbitrarily changed by anything other than administrator action. All changes to -MAC policy should be audited. - - CCE-82586-9 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -w%20/etc/selinux/%20-p%20wa%20-k%20MAC-policy%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-etcselinux-wa-MAC-policy.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on Exporting to Media (successful) - At a minimum, the audit system should collect media exportation -events for all users and root. If the auditd daemon is configured to -use the augenrules program to read audit rules during daemon startup -(the default), add the following line to a file with suffix .rules in -the directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - The unauthorized exportation of data to external media could result in an information leak -where classified information, Privacy Act information, and intellectual property could be lost. An audit -trail should be created each time a filesystem is mounted to help identify and guard against information -loss. - - CCE-82587-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20mount%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20mount%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-mount_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Network Environment - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification --w /etc/issue -p wa -k audit_rules_networkconfig_modification --w /etc/issue.net -p wa -k audit_rules_networkconfig_modification --w /etc/hosts -p wa -k audit_rules_networkconfig_modification --w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification --w /etc/issue -p wa -k audit_rules_networkconfig_modification --w /etc/issue.net -p wa -k audit_rules_networkconfig_modification --w /etc/hosts -p wa -k audit_rules_networkconfig_modification --w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.5.5 - The network environment should not be modified by anything other -than administrator action. Any change to network parameters should be -audited. - - CCE-82588-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20sethostname%2Csetdomainname%20-F%20key%3Daudit_rules_networkconfig_modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20sethostname%2Csetdomainname%20-F%20key%3Daudit_rules_networkconfig_modification%0A-w%20/etc/issue%20-p%20wa%20-k%20audit_rules_networkconfig_modification%0A-w%20/etc/issue.net%20-p%20wa%20-k%20audit_rules_networkconfig_modification%0A-w%20/etc/hosts%20-p%20wa%20-k%20audit_rules_networkconfig_modification%0A-w%20/etc/sysconfig/network%20-p%20wa%20-k%20audit_rules_networkconfig_modification%0A - mode: 0644 - path: /etc/audit/rules.d/75-audit_rules_networkconfig_modification.rules - overwrite: true - - - - - - - - - - Record Attempts to Alter Process and Session Initiation Information - The audit system already collects process information for all -users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual -edits of files involved in storing such process information: --w /var/run/utmp -p wa -k session --w /var/log/btmp -p wa -k session --w /var/log/wtmp -p wa -k session -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file in order to watch for attempted manual -edits of files involved in storing such process information: --w /var/run/utmp -p wa -k session --w /var/log/btmp -p wa -k session --w /var/log/wtmp -p wa -k session - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - 0582 - 0584 - 05885 - 0586 - 0846 - 0957 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.3 - Manual editing of these files may indicate nefarious activity, such -as an attacker attempting to remove evidence of an intrusion. - - CCE-82612-3 - --- - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A-w%20/var/run/utmp%20-p%20wa%20-k%20session%0A-w%20/var/log/btmp%20-p%20wa%20-k%20session%0A-w%20/var/log/wtmp%20-p%20wa%20-k%20session%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-audit-session-events.rules - overwrite: true - - - - - - - Ensure auditd Collects System Administrator Actions - At a minimum, the audit system should collect administrator actions -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the default), -add the following line to a file with suffix .rules in the directory -/etc/audit/rules.d: --w /etc/sudoers -p wa -k actions --w /etc/sudoers.d/ -p wa -k actions -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --w /etc/sudoers -p wa -k actions --w /etc/sudoers.d/ -p wa -k actions - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - AC-2(7)(b) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-1 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.2 - Req-10.2.5.b - SRG-OS-000004-GPOS-00004 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000304-GPOS-00121 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000470-GPOS-00214 - SRG-OS-000471-GPOS-00215 - SRG-OS-000239-GPOS-00089 - SRG-OS-000240-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000304-GPOS-00121 - SRG-OS-000466-GPOS-00210 - SRG-OS-000476-GPOS-00221 - SRG-OS-000462-VMM-001840 - SRG-OS-000471-VMM-001910 - The actions taken by system administrators should be audited to keep a record -of what was executed on the system, as well as, for accountability purposes. - - CCE-82613-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -w%20/etc/sudoers.d/%20-p%20wa%20-k%20actions%0A-w%20/etc/sudoers%20-p%20wa%20-k%20actions%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-audit-sysadmin-actions.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d, in order to capture events that modify -account changes: --w /etc/group -p wa -k audit_rules_usergroup_modification --w /etc/passwd -p wa -k audit_rules_usergroup_modification --w /etc/gshadow -p wa -k audit_rules_usergroup_modification --w /etc/shadow -p wa -k audit_rules_usergroup_modification --w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file, in order to capture events that modify -account changes: --w /etc/group -p wa -k audit_rules_usergroup_modification --w /etc/passwd -p wa -k audit_rules_usergroup_modification --w /etc/gshadow -p wa -k audit_rules_usergroup_modification --w /etc/shadow -p wa -k audit_rules_usergroup_modification --w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification - This rule checks for multiple syscalls related to account changes; -it was written with DISA STIG in mind. Other policies should use a -separate rule for each syscall that needs to be checked. For example: -audit_rules_usergroup_modification_groupaudit_rules_usergroup_modification_gshadowaudit_rules_usergroup_modification_passwd - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000018 - CCI-000130 - CCI-000172 - CCI-001403 - CCI-002130 - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-1 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.2.5 - SRG-OS-000004-GPOS-00004 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000239-GPOS-00089 - SRG-OS-000241-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000476-GPOS-00221 - In addition to auditing new user and group accounts, these watches -will alert the system administrator(s) to any modifications. Any unexpected -users, groups, or modifications should be investigated for legitimacy. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/etc/group%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A-w%20/etc/passwd%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A-w%20/etc/gshadow%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A-w%20/etc/shadow%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A-w%20/etc/security/opasswd%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A - mode: 0644 - path: /etc/audit/rules.d/75-audit_rules_usergroup_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information - /etc/group - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d, in order to capture events that modify -account changes: - --w /etc/group -p wa -k audit_rules_usergroup_modification - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file, in order to capture events that modify -account changes: - --w /etc/group -p wa -k audit_rules_usergroup_modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000018 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-001403 - CCI-001404 - CCI-001405 - CCI-001683 - CCI-001684 - CCI-001685 - CCI-001686 - CCI-002130 - CCI-002132 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-1 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.5 - SRG-OS-000004-GPOS-00004 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000304-GPOS-00121 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000470-GPOS-00214 - SRG-OS-000471-GPOS-00215 - SRG-OS-000239-GPOS-00089 - SRG-OS-000240-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000466-GPOS-00210 - SRG-OS-000476-GPOS-00221 - SRG-OS-000004-VMM-000040 - SRG-OS-000239-VMM-000810 - SRG-OS-000240-VMM-000820 - SRG-OS-000241-VMM-000830 - SRG-OS-000274-VMM-000960 - SRG-OS-000275-VMM-000970 - SRG-OS-000276-VMM-000980 - SRG-OS-000277-VMM-000990 - SRG-OS-000303-VMM-001090 - SRG-OS-000304-VMM-001100 - SRG-OS-000476-VMM-001960 - In addition to auditing new user and group accounts, these watches -will alert the system administrator(s) to any modifications. Any unexpected -users, groups, or modifications should be investigated for legitimacy. - - CCE-82654-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/etc/group%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A - mode: 0644 - path: /etc/audit/rules.d/30-etc_group_usergroup_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information - /etc/gshadow - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d, in order to capture events that modify -account changes: - --w /etc/gshadow -p wa -k audit_rules_usergroup_modification - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file, in order to capture events that modify -account changes: - --w /etc/gshadow -p wa -k audit_rules_usergroup_modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000018 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-001403 - CCI-001404 - CCI-001405 - CCI-001683 - CCI-001684 - CCI-001685 - CCI-001686 - CCI-002130 - CCI-002132 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-1 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.5 - SRG-OS-000004-GPOS-00004 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000304-GPOS-00121 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000470-GPOS-00214 - SRG-OS-000471-GPOS-00215 - SRG-OS-000239-GPOS-00089 - SRG-OS-000240-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000466-GPOS-00210 - SRG-OS-000476-GPOS-00221 - SRG-OS-000004-VMM-000040 - SRG-OS-000239-VMM-000810 - SRG-OS-000240-VMM-000820 - SRG-OS-000241-VMM-000830 - SRG-OS-000274-VMM-000960 - SRG-OS-000275-VMM-000970 - SRG-OS-000276-VMM-000980 - SRG-OS-000277-VMM-000990 - SRG-OS-000303-VMM-001090 - SRG-OS-000304-VMM-001100 - SRG-OS-000476-VMM-001960 - In addition to auditing new user and group accounts, these watches -will alert the system administrator(s) to any modifications. Any unexpected -users, groups, or modifications should be investigated for legitimacy. - - CCE-82655-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/etc/gshadow%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A - mode: 0644 - path: /etc/audit/rules.d/30-etc_gshadow_usergroup_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information - /etc/security/opasswd - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d, in order to capture events that modify -account changes: - --w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file, in order to capture events that modify -account changes: - --w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000018 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-001403 - CCI-001404 - CCI-001405 - CCI-001683 - CCI-001684 - CCI-001685 - CCI-001686 - CCI-002130 - CCI-002132 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-1 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.5 - SRG-OS-000004-GPOS-00004 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000304-GPOS-00121 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000470-GPOS-00214 - SRG-OS-000471-GPOS-00215 - SRG-OS-000239-GPOS-00089 - SRG-OS-000240-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000466-GPOS-00210 - SRG-OS-000476-GPOS-00221 - SRG-OS-000004-VMM-000040 - SRG-OS-000239-VMM-000810 - SRG-OS-000240-VMM-000820 - SRG-OS-000241-VMM-000830 - SRG-OS-000274-VMM-000960 - SRG-OS-000275-VMM-000970 - SRG-OS-000276-VMM-000980 - SRG-OS-000277-VMM-000990 - SRG-OS-000303-VMM-001090 - SRG-OS-000304-VMM-001100 - SRG-OS-000476-VMM-001960 - In addition to auditing new user and group accounts, these watches -will alert the system administrator(s) to any modifications. Any unexpected -users, groups, or modifications should be investigated for legitimacy. - - CCE-82656-0 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/etc/security/opasswd%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A - mode: 0644 - path: /etc/audit/rules.d/30-etc_security_opasswd_usergroup_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information - /etc/passwd - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d, in order to capture events that modify -account changes: - --w /etc/passwd -p wa -k audit_rules_usergroup_modification - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file, in order to capture events that modify -account changes: - --w /etc/passwd -p wa -k audit_rules_usergroup_modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000018 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-001403 - CCI-001404 - CCI-001405 - CCI-001683 - CCI-001684 - CCI-001685 - CCI-001686 - CCI-002130 - CCI-002132 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-1 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.5 - SRG-OS-000004-GPOS-00004 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000304-GPOS-00121 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000470-GPOS-00214 - SRG-OS-000471-GPOS-00215 - SRG-OS-000239-GPOS-00089 - SRG-OS-000240-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000304-GPOS-00121 - SRG-OS-000466-GPOS-00210 - SRG-OS-000476-GPOS-00221 - SRG-OS-000274-GPOS-00104 - SRG-OS-000275-GPOS-00105 - SRG-OS-000276-GPOS-00106 - SRG-OS-000277-GPOS-00107 - SRG-OS-000004-VMM-000040 - SRG-OS-000239-VMM-000810 - SRG-OS-000240-VMM-000820 - SRG-OS-000241-VMM-000830 - SRG-OS-000274-VMM-000960 - SRG-OS-000275-VMM-000970 - SRG-OS-000276-VMM-000980 - SRG-OS-000277-VMM-000990 - SRG-OS-000303-VMM-001090 - SRG-OS-000304-VMM-001100 - SRG-OS-000476-VMM-001960 - In addition to auditing new user and group accounts, these watches -will alert the system administrator(s) to any modifications. Any unexpected -users, groups, or modifications should be investigated for legitimacy. - - CCE-82657-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/etc/passwd%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A - mode: 0644 - path: /etc/audit/rules.d/30-etc_passwd_usergroup_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify User/Group Information - /etc/shadow - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d, in order to capture events that modify -account changes: - --w /etc/shadow -p wa -k audit_rules_usergroup_modification - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file, in order to capture events that modify -account changes: - --w /etc/shadow -p wa -k audit_rules_usergroup_modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000018 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-001403 - CCI-001404 - CCI-001405 - CCI-001683 - CCI-001684 - CCI-001685 - CCI-001686 - CCI-002130 - CCI-002132 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-1 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.5 - SRG-OS-000004-GPOS-00004 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000304-GPOS-00121 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000470-GPOS-00214 - SRG-OS-000471-GPOS-00215 - SRG-OS-000239-GPOS-00089 - SRG-OS-000240-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000466-GPOS-00210 - SRG-OS-000476-GPOS-00221 - SRG-OS-000004-VMM-000040 - SRG-OS-000239-VMM-000810 - SRG-OS-000240-VMM-000820 - SRG-OS-000241-VMM-000830 - SRG-OS-000274-VMM-000960 - SRG-OS-000275-VMM-000970 - SRG-OS-000276-VMM-000980 - SRG-OS-000277-VMM-000990 - SRG-OS-000303-VMM-001090 - SRG-OS-000304-VMM-001100 - SRG-OS-000476-VMM-001960 - In addition to auditing new user and group accounts, these watches -will alert the system administrator(s) to any modifications. Any unexpected -users, groups, or modifications should be investigated for legitimacy. - - CCE-82658-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/etc/shadow%20-p%20wa%20-k%20audit_rules_usergroup_modification%0A - mode: 0644 - path: /etc/audit/rules.d/30-etc_shadow_usergroup_modification.rules - overwrite: true - - - - - - - - - - Record Access Events to Audit Log Directory - The audit system should collect access events to read audit log directory. -The following audit rule will assure that access to audit log directory are -collected. --a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rule to a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rule to -/etc/audit/audit.rules file. - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system. -Auditing these events could serve as evidence of potential system compromise.' - - CCE-82712-1 - --- -# - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20dir%3D/var/log/audit/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A }} - mode: 0600 - path: /etc/audit/rules.d/30-access-var-log-audit.rules - overwrite: true - - - - - - - - - - System Audit Logs Must Have Mode 0750 or Less Permissive - -If log_group in /etc/audit/auditd.conf is set to a group other than the root -group account, change the mode of the audit log files with the following command: -$ sudo chmod 0750 /var/log/audit - -Otherwise, change the mode of the audit log files with the following command: -$ sudo chmod 0700 /var/log/audit - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - CCI-000162 - CCI-000163 - CCI-000164 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.2 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-004-6 R3.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CIP-007-3 R6.5 - CM-6(a) - AC-6(1) - AU-9 - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-82692-5 - - - - - - - - - Audit Configuration Files Must Be Owned By Group root - All audit configuration files must be owned by group root. -chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/* - CCI-000171 - SRG-OS-000063-GPOS-00032 - Without the capability to restrict which roles and individuals can -select which events are audited, unauthorized personnel may be able -to prevent the auditing of critical events. -Misconfigured audits may degrade the system's performance by -overwhelming the audit log. Misconfigured audits may also make it more -difficult to establish, correlate, and investigate the events relating -to an incident or identify those responsible for one. - - - - - - - - - - Audit Configuration Files Must Be Owned By Root - All audit configuration files must be owned by root user. - -To properly set the owner of /etc/audit/, run the command: -$ sudo chown root /etc/audit/ - -To properly set the owner of /etc/audit/rules.d/, run the command: -$ sudo chown root /etc/audit/rules.d/ - CCI-000171 - SRG-OS-000063-GPOS-00032 - Without the capability to restrict which roles and individuals can -select which events are audited, unauthorized personnel may be able -to prevent the auditing of critical events. -Misconfigured audits may degrade the system's performance by -overwhelming the audit log. Misconfigured audits may also make it more -difficult to establish, correlate, and investigate the events relating -to an incident or identify those responsible for one. - - - - - - - - - - System Audit Logs Must Be Owned By Root - All audit logs must be owned by root user and group. By default, the path for audit log is /var/log/audit/. - -To properly set the owner of /var/log/audit, run the command: -$ sudo chown root /var/log/audit - -To properly set the owner of /var/log/audit/*, run the command: -$ sudo chown root /var/log/audit/* - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - CCI-000162 - CCI-000163 - CCI-000164 - CCI-001314 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5.1 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - Unauthorized disclosure of audit records can reveal system and configuration data to -attackers, thus compromising its confidentiality. - - CCE-82691-7 - - - - - - - - - System Audit Logs Must Have Mode 0640 or Less Permissive - -If log_group in /etc/audit/auditd.conf is set to a group other than the -root -group account, change the mode of the audit log files with the following command: -$ sudo chmod 0640 audit_file - -Otherwise, change the mode of the audit log files with the following command: -$ sudo chmod 0600 audit_file - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO01.06 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - DSS06.02 - MEA02.01 - 3.3.1 - CCI-000162 - CCI-000163 - CCI-000164 - CCI-001314 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.7.3 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 5.2 - SR 6.1 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - AU-9(4) - DE.AE-3 - DE.AE-5 - PR.AC-4 - PR.DS-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.5 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - SRG-OS-000206-GPOS-00084 - If users can write to audit logs, audit trails can be modified or destroyed. - - CCE-82690-9 - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - At a minimum, the audit system should collect file permission -changes for all users and root. Note that the "-F arch=b32" lines should be -present even on a 64 bit system. These commands identify system calls for -auditing. Even if the system is 64 bit it can still execute 32 bit system -calls. Additionally, these rules can be configured in a number of ways while -still achieving the desired effect. An example of this is that the "-S" calls -could be split up and placed on separate lines, however, this is less efficient. -Add the following to /etc/audit/audit.rules: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod - -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -F key=perm_mod - -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If your system is 64 bit then these lines should be duplicated and the -arch=b32 replaced with arch=b64 as follows: --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod - -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -F key=perm_mod - -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - - - Record Events that Modify the System's Discretionary Access Controls - chmod - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured to -use the augenrules program to read audit rules during daemon startup -(the default), add the following line to a file with suffix .rules in -the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000466-GPOS-00210 - SRG-OS-000458-GPOS-00203 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82556-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20chmod%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20chmod%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-chmod_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - chown - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured to -use the augenrules program to read audit rules during daemon startup -(the default), add the following line to a file with suffix .rules in -the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000466-GPOS-00210 - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82557-0 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20chown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20chown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-chown_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchmod - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured to -use the augenrules program to read audit rules during daemon startup -(the default), add the following line to a file with suffix .rules in -the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000466-GPOS-00210 - SRG-OS-000458-GPOS-00203 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82558-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchmod%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchmod%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchmod_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchmodat - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured to -use the augenrules program to read audit rules during daemon startup -(the default), add the following line to a file with suffix .rules in -the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000466-GPOS-00210 - SRG-OS-000458-GPOS-00203 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82559-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchmodat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchmodat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchmodat_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchown - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000466-GPOS-00210 - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82560-4 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchown_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchownat - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000466-GPOS-00210 - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82561-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchownat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchownat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchownat_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fremovexattr - At a minimum, the audit system should collect file permission -changes for all users and root. - -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000471-GPOS-00215 - SRG-OS-000474-GPOS-00219 - SRG-OS-000466-GPOS-00210 - SRG-OS-000468-GPOS-00212 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82562-0 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fremovexattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fremovexattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-fremovexattr_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fsetxattr - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000466-GPOS-00210 - SRG-OS-000468-GPOS-00212 - SRG-OS-000471-GPOS-00215 - SRG-OS-000474-GPOS-00219 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82563-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fsetxattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fsetxattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-fsetxattr_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - lchown - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000466-GPOS-00210 - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82564-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lchown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lchown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-lchown_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - lremovexattr - At a minimum, the audit system should collect file permission -changes for all users and root. - -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000468-GPOS-00212 - SRG-OS-000471-GPOS-00215 - SRG-OS-000474-GPOS-00219 - SRG-OS-000466-GPOS-00210 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82565-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lremovexattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lremovexattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-lremovexattr_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - lsetxattr - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000466-GPOS-00210 - SRG-OS-000468-GPOS-00212 - SRG-OS-000471-GPOS-00215 - SRG-OS-000474-GPOS-00219 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82566-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lsetxattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lsetxattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-lsetxattr_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - removexattr - At a minimum, the audit system should collect file permission -changes for all users and root. - -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -following line to a file with suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000468-GPOS-00212 - SRG-OS-000471-GPOS-00215 - SRG-OS-000474-GPOS-00219 - SRG-OS-000466-GPOS-00210 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82567-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20removexattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20removexattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-removexattr_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - setxattr - At a minimum, the audit system should collect file permission -changes for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.5 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000466-GPOS-00210 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000458-VMM-001810 - SRG-OS-000474-VMM-001940 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - CCE-82568-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20setxattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20setxattr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-setxattr_dac_modification.rules - overwrite: true - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - umount - At a minimum, the audit system should collect file system umount -changes. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - CCI-000130 - CCI-000169 - CCI-000172 - CCI-002884 - SRG-OS-000037-GPOS-00015 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - umount2 - At a minimum, the audit system should collect file system umount2 -changes. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following line to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - CCI-000130 - CCI-000169 - CCI-000172 - CCI-002884 - SRG-OS-000037-GPOS-00015 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - The changing of file permissions could indicate that a user is attempting to -gain access to information that would otherwise be disallowed. Auditing DAC modifications -can facilitate the identification of patterns of abuse among both authorized and -unauthorized users. - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20umount2%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20umount2%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dperm_mod%0A - mode: 0644 - path: /etc/audit/rules.d/75-umount2_dac_modification.rules - overwrite: true - - - - - - - - - - - Record Execution Attempts to Run ACL Privileged Commands - At a minimum, the audit system should collect the execution of -ACL privileged commands for all users and root. - - - - Record Execution Attempts to Run SELinux Privileged Commands - At a minimum, the audit system should collect the execution of -SELinux privileged commands for all users and root. - - - Record Any Attempts to Run chcon - At a minimum, the audit system should collect any execution attempt -of the chcon command for all users and root. If the auditd -daemon is configured to use the augenrules program to read audit rules -during daemon startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000468-GPOS-00212 - SRG-OS-000471-GPOS-00215 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000463-VMM-001850 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82569-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/chcon%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_chcon_execution.rules - overwrite: true - - - - - - - - - - Record Any Attempts to Run restorecon - At a minimum, the audit system should collect any execution attempt -of the restorecon command for all users and root. If the auditd -daemon is configured to use the augenrules program to read audit rules -during daemon startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/restorecon -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F path=/usr/sbin/restorecon -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000392-GPOS-00172 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000463-VMM-001850 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82570-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/restorecon%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_restorecon_execution.rules - overwrite: true - - - - - - - - - - Record Any Attempts to Run semanage - At a minimum, the audit system should collect any execution attempt -of the semanage command for all users and root. If the auditd -daemon is configured to use the augenrules program to read audit rules -during daemon startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000463-VMM-001850 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82571-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/semanage%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_semanage_execution.rules - overwrite: true - - - - - - - - - - Record Any Attempts to Run setfiles - At a minimum, the audit system should collect any execution attempt -of the setfiles command for all users and root. If the auditd -daemon is configured to use the augenrules program to read audit rules -during daemon startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000169 - CCI-000172 - CCI-002884 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000463-VMM-001850 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82572-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/setfiles%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_setfiles_execution.rules - overwrite: true - - - - - - - - - - Record Any Attempts to Run setsebool - At a minimum, the audit system should collect any execution attempt -of the setsebool command for all users and root. If the auditd -daemon is configured to use the augenrules program to read audit rules -during daemon startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000463-VMM-001850 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82573-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/setsebool%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_setsebool_execution.rules - overwrite: true - - - - - - - - - - Record Any Attempts to Run seunshare - At a minimum, the audit system should collect any execution attempt -of the seunshare command for all users and root. If the auditd -daemon is configured to use the augenrules program to read audit rules -during daemon startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/seunshare -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F path=/usr/sbin/seunshare -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - SRG-OS-000463-VMM-001850 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82574-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/seunshare%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_seunshare_execution.rules - overwrite: true - - - - - - - - - - - Record File Deletion Events by User - At a minimum, the audit system should collect file deletion events -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=delete -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=delete - - - Ensure auditd Collects File Deletion Events by User - At a minimum the audit system should collect file deletion events -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=delete -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename -S renameat -F auid>=1000 -F auid!=unset -F key=delete - This rule checks for multiple syscalls related to file deletion; -it was written with DISA STIG in mind. Other policies should use a -separate rule for each syscall that needs to be checked. For example: -audit_rules_file_deletion_events_rmdiraudit_rules_file_deletion_events_unlinkaudit_rules_file_deletion_events_unlinkat - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000366 - CCI-000172 - CCI-002884 - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting, as well as, detecting -malicious processes that attempt to delete log files to conceal their presence. - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - rename - At a minimum, the audit system should collect file deletion events -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-000366 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.4 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.1.1 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.MA-2 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000466-GPOS-00210 - SRG-OS-000467-GPOS-00211 - SRG-OS-000468-GPOS-00212 - SRG-OS-000466-VMM-001870 - SRG-OS-000468-VMM-001890 - Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting, as well as, detecting -malicious processes that attempt to delete log files to conceal their presence. - - CCE-82575-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20rename%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20rename%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A - mode: 0644 - path: /etc/audit/rules.d/75-rename-file-deletion-events.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - renameat - At a minimum, the audit system should collect file deletion events -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-000366 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.4 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.1.1 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.MA-2 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000466-GPOS-00210 - SRG-OS-000467-GPOS-00211 - SRG-OS-000468-GPOS-00212 - SRG-OS-000466-VMM-001870 - SRG-OS-000468-VMM-001890 - Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting, as well as, detecting -malicious processes that attempt to delete log files to conceal their presence. - - CCE-82576-0 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20renameat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20renameat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A - mode: 0644 - path: /etc/audit/rules.d/75-renameat-file-deletion-events.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - rmdir - At a minimum, the audit system should collect file deletion events -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-000366 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.4 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.1.1 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.MA-2 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000466-GPOS-00210 - SRG-OS-000467-GPOS-00211 - SRG-OS-000468-GPOS-00212 - SRG-OS-000466-VMM-001870 - SRG-OS-000468-VMM-001890 - Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting, as well as, detecting -malicious processes that attempt to delete log files to conceal their presence. - - CCE-82577-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20rmdir%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20rmdir%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A - mode: 0644 - path: /etc/audit/rules.d/75-rmdir-file-deletion-events.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - unlink - At a minimum, the audit system should collect file deletion events -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-000366 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.4 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.1.1 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.MA-2 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000466-GPOS-00210 - SRG-OS-000467-GPOS-00211 - SRG-OS-000468-GPOS-00212 - SRG-OS-000466-VMM-001870 - SRG-OS-000468-VMM-001890 - Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting, as well as, detecting -malicious processes that attempt to delete log files to conceal their presence. - - CCE-82578-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlink%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A - mode: 0644 - path: /etc/audit/rules.d/75-unlink-file-deletion-events.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - unlinkat - At a minimum, the audit system should collect file deletion events -for all users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as -appropriate for your system: --a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-000366 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.4 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.1.1 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.MA-2 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000466-GPOS-00210 - SRG-OS-000467-GPOS-00211 - SRG-OS-000468-GPOS-00212 - SRG-OS-000466-VMM-001870 - SRG-OS-000468-VMM-001890 - Auditing file deletions will create an audit trail for files that are removed -from the system. The audit trail could aid in system troubleshooting, as well as, detecting -malicious processes that attempt to delete log files to conceal their presence. - - CCE-82579-4 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlinkat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlinkat%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Ddelete%0A - mode: 0644 - path: /etc/audit/rules.d/75-unlinkat-file-deletion-events.rules - overwrite: true - - - - - - - - - - - Record Unauthorized Access Attempts Events to Files (unsuccessful) - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. Note that the "-F arch=b32" lines should be -present even on a 64 bit system. These commands identify system calls for -auditing. Even if the system is 64 bit it can still execute 32 bit system -calls. Additionally, these rules can be configured in a number of ways while -still achieving the desired effect. An example of this is that the "-S" calls -could be split up and placed on separate lines, however, this is less efficient. -Add the following to /etc/audit/audit.rules: --a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access - -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If your system is 64 bit then these lines should be duplicated and the -arch=b32 replaced with arch=b64 as follows: --a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access - -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - - - Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) - At a minimum the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - This rule checks for multiple syscalls related to unsuccessful file modification; -it was written with DISA STIG in mind. Other policies should use a -separate rule for each syscall that needs to be checked. For example: -audit_rules_unsuccessful_file_modification_openaudit_rules_unsuccessful_file_modification_ftruncateaudit_rules_unsuccessful_file_modification_creat - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - 0582 - 0584 - 05885 - 0586 - 0846 - 0957 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.2.4 - Req-10.2.1 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - - - - - - - - - Record Unsuccessful Permission Changes to Files - chmod - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S chmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S chmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S chmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S chmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82619-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20chmod%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20chmod%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20chmod%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20chmod%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-chmod_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - chown - The audit system should collect unsuccessful file ownership change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S chown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S chown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S chown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S chown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82620-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20chown%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20chown%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20chown%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20chown%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-chown_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Access Attempts to Files - creat - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82621-4 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fchmod - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S fchmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S fchmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S fchmod -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S fchmod -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82622-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchmod%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchmod%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchmod%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchmod%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchmod_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fchmodat - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S fchmodat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S fchmodat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S fchmodat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S fchmodat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82624-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchmodat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchmodat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchmodat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchmodat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchmodat_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - fchown - The audit system should collect unsuccessful file ownership change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82625-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchown%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchown%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchown%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchown%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchown_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - fchownat - The audit system should collect unsuccessful file ownership change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82626-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchownat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fchownat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchownat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fchownat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-fchownat_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fremovexattr - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82627-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fremovexattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fremovexattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fremovexattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fremovexattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-fremovexattr_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fsetxattr - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82628-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fsetxattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20fsetxattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fsetxattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20fsetxattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-fsetxattr_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Access Attempts to Files - ftruncate - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82629-7 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - lchown - The audit system should collect unsuccessful file ownership change -attempts for all users and root. - -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S lchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S lchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S lchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S lchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82630-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lchown%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lchown%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lchown%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lchown%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-lchown_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Permission Changes to Files - lremovexattr - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S lremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S lremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S lremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S lremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82631-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lremovexattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lremovexattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lremovexattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lremovexattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-lremovexattr_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Permission Changes to Files - lsetxattr - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S lsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S lsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S lsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S lsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82632-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lsetxattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20lsetxattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lsetxattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20lsetxattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-lsetxattr_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Access Attempts to Files - open - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82633-9 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Access Attempts to Files - open_by_handle_at - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82640-4 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT - The audit system should collect unauthorized file accesses for -all users and root. The open_by_handle_at syscall can be used to create new files -when O_CREAT flag is specified. - -The following auidt rules will asure that unsuccessful attempts to create a -file via open_by_handle_at syscall are collected. - -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rules below to a file with suffix .rules in the directory -/etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rules below to -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82641-2 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE - The audit system should collect detailed unauthorized file accesses for -all users and root. The open_by_handle_at syscall can be used to modify files -if called for write operation of with O_TRUNC_WRITE flag. - -The following auidt rules will asure that unsuccessful attempts to modify a -file via open_by_handle_at syscall are collected. - -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rules below to a file with suffix .rules in the directory -/etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rules below to -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82642-0 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly - The audit system should collect detailed unauthorized file -accesses for all users and root. -To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access -of files via open_by_handle_at syscall the audit rules collecting these events need to be in certain order. -The more specific rules need to come before the less specific rules. The reason for that is that more -specific rules cover a subset of events covered in the less specific rules, thus, they need to come -before to not be overshadowed by less specific rules, which match a bigger set of events. -Make sure that rules for unsuccessful calls of open_by_handle_at syscall are in the order shown below. -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), check the order of -rules below in a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, check the order of rules below in -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access --a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access --a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - The more specific rules cover a subset of events covered by the less specific rules. -By ordering them from more specific to less specific, it is assured that the less specific -rule will not catch events better recorded by the more specific rule. - - CCE-82643-8 - - - - - - - - - Record Unsuccessful Creation Attempts to Files - open O_CREAT - The audit system should collect unauthorized file accesses for -all users and root. The open syscall can be used to create new files -when O_CREAT flag is specified. - -The following auidt rules will asure that unsuccessful attempts to create a -file via open syscall are collected. - -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rules below to a file with suffix .rules in the directory -/etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rules below to -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82644-6 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE - The audit system should collect detailed unauthorized file accesses for -all users and root. The open syscall can be used to modify files -if called for write operation of with O_TRUNC_WRITE flag. -The following auidt rules will asure that unsuccessful attempts to modify a -file via open syscall are collected. -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rules below to a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rules below to -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82645-3 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly - The audit system should collect detailed unauthorized file -accesses for all users and root. -To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access -of files via open syscall the audit rules collecting these events need to be in certain order. -The more specific rules need to come before the less specific rules. The reason for that is that more -specific rules cover a subset of events covered in the less specific rules, thus, they need to come -before to not be overshadowed by less specific rules, which match a bigger set of events. -Make sure that rules for unsuccessful calls of open syscall are in the order shown below. -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), check the order of -rules below in a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, check the order of rules below in -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access --a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access --a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - The more specific rules cover a subset of events covered by the less specific rules. -By ordering them from more specific to less specific, it is assured that the less specific -rule will not catch events better recorded by the more specific rule. - - CCE-82646-1 - - - - - - - - - Record Unsuccessful Access Attempts to Files - openat - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82634-7 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Creation Attempts to Files - openat O_CREAT - The audit system should collect unauthorized file accesses for -all users and root. The openat syscall can be used to create new files -when O_CREAT flag is specified. - -The following auidt rules will asure that unsuccessful attempts to create a -file via openat syscall are collected. - -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rules below to a file with suffix .rules in the directory -/etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rules below to -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82635-4 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE - The audit system should collect detailed unauthorized file accesses for -all users and root. The openat syscall can be used to modify files -if called for write operation of with O_TRUNC_WRITE flag. - -The following auidt rules will asure that unsuccessful attempts to modify a -file via openat syscall are collected. - -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add the -rules below to a file with suffix .rules in the directory -/etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the rules below to -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82636-2 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly - The audit system should collect detailed unauthorized file -accesses for all users and root. -To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access -of files via openat syscall the audit rules collecting these events need to be in certain order. -The more specific rules need to come before the less specific rules. The reason for that is that more -specific rules cover a subset of events covered in the less specific rules, thus, they need to come -before to not be overshadowed by less specific rules, which match a bigger set of events. -Make sure that rules for unsuccessful calls of openat syscall are in the order shown below. -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), check the order of -rules below in a file with suffix .rules in the directory -/etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, check the order of rules below in -/etc/audit/audit.rules file. - --a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access --a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification --a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access --a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - The more specific rules cover a subset of events covered by the less specific rules. -By ordering them from more specific to less specific, it is assured that the less specific -rule will not catch events better recorded by the more specific rule. - - CCE-82639-6 - - - - - - - - - Record Unsuccessful Permission Changes to Files - removexattr - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S removexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S removexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S removexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S removexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82647-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20removexattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20removexattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20removexattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20removexattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-removexattr_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - rename - The audit system should collect unsuccessful file deletion -attempts for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000468-GPOS-00212 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82648-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20rename%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20rename%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20rename%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20rename%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-rename_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - renameat - -The audit system should collect unsuccessful file deletion -attempts for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: - --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000468-GPOS-00212 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82649-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20renameat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20renameat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20renameat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20renameat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-renameat_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Permission Changes to Files - setxattr - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S setxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b32 -S setxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change -If the system is 64 bit then also add the following lines: --a always,exit -F arch=b64 -S setxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change --a always,exit -F arch=b64 -S setxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the audit rule checks a -system call independently of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change - CCI-000172 - AU-2(d) - AU-12(c) - CM-6(a) - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82650-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20setxattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20setxattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20setxattr%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20setxattr%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-setxattr_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Access Attempts to Files - truncate - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access --a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping these system -calls with others as identifying earlier in this guide is more efficient. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000064-GPOS-00033 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82651-1 - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20This%20content%20is%20a%20section%20of%20an%20Audit%20config%20snapshot%20recommended%20for%20Red%2520Hat%2520Enterprise%2520Linux%2520CoreOS%25204%20systems%20that%20target%20OSPP%20compliance.%0A%23%23%20The%20following%20content%20has%20been%20retreived%20on%202019-03-11%20from%3A%20https%3A//github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules%0A%0A%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%20and%2043-module-load.rules%20installed.%0A%0A%23%23%20Unsuccessful%20file%20creation%20%28open%20with%20O_CREAT%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%260100%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20creat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-create%0A%0A%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-modification%0A%0A%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Ccreat%2Ctruncate%2Cftruncate%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccesful-access }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-remediation.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - unlink - -The audit system should collect unsuccessful file deletion -attempts for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: - --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000468-GPOS-00212 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82652-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlink%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlink%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-unlink_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - unlinkat - -The audit system should collect unsuccessful file deletion -attempts for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file. --a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - -If the system is 64 bit then also add the following lines: - --a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - Note that these rules can be configured in a -number of ways while still achieving the desired effect. Here the system calls -have been placed independent of other system calls. Grouping system calls related -to the same event is more efficient. See the following example: - --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.4 - Req-10.2.1 - SRG-OS-000064-GPOS-00033 - SRG-OS-000392-GPOS-00172 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000468-GPOS-00212 - SRG-OS-000458-VMM-001810 - SRG-OS-000461-VMM-001830 - Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. - - CCE-82653-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlinkat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlinkat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlinkat%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlinkat%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess%0A - mode: 0644 - path: /etc/audit/rules.d/75-unlinkat_audit_rules_unsuccessful_file_modification.rules - overwrite: true - - - - - - - - - - - Record Information on Kernel Modules Loading and Unloading - To capture kernel module loading and unloading events, use following lines, setting ARCH to -either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: - --a always,exit -F arch=ARCH -S init_module,delete_module -F key=modules - - -Place to add the lines depends on a way auditd daemon is configured. If it is configured -to use the augenrules program (the default), add the lines to a file with suffix -.rules in the directory /etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl utility, -add the lines to file /etc/audit/audit.rules. - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - To capture kernel module loading and unloading events, use following lines, setting ARCH to -either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: - --a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules - - -The place to add the lines depends on a way auditd daemon is configured. If it is configured -to use the augenrules program (the default), add the lines to a file with suffix -.rules in the directory /etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl utility, -add the lines to file /etc/audit/audit.rules. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.2.7 - The addition/removal of kernel modules can be used to alter the behavior of -the kernel and potentially introduce malicious code into kernel space. It is important -to have an audit trail of modules that have been introduced into the kernel. - - - - - - - - - - Ensure auditd Collects Information on Kernel Module Unloading - delete_module - To capture kernel module unloading events, use following line, setting ARCH to -either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: - --a always,exit -F arch=ARCH -S delete_module -F key=modules - - -Place to add the line depends on a way auditd daemon is configured. If it is configured -to use the augenrules program (the default), add the line to a file with suffix -.rules in the directory /etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl utility, -add the line to file /etc/audit/audit.rules. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-GPOS-00216 - SRG-OS-000477-GPOS-00222 - SRG-OS-000477-VMM-001970 - The removal of kernel modules can be used to alter the behavior of -the kernel and potentially introduce malicious code into kernel space. It is important -to have an audit trail of modules that have been introduced into the kernel. - - CCE-82580-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A - mode: 0600 - path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module - If the auditd daemon is configured to use the augenrules program -to read audit rules during daemon startup (the default), add the following lines to a file -with suffix .rules in the directory /etc/audit/rules.d to capture kernel module -loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system: - --a always,exit -F arch=ARCH -S finit_module -F key=modules - If the auditd daemon is configured to use the auditctl utility to read audit -rules during daemon startup, add the following lines to /etc/audit/audit.rules file -in order to capture kernel module loading and unloading events, setting ARCH to either b32 or -b64 as appropriate for your system: - --a always,exit -F arch=ARCH -S finit_module -F key=modules - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-GPOS-00216 - SRG-OS-000477-GPOS-00222 - SRG-OS-000477-VMM-001970 - The addition/removal of kernel modules can be used to alter the behavior of -the kernel and potentially introduce malicious code into kernel space. It is important -to have an audit trail of modules that have been introduced into the kernel. - - CCE-82581-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20finit_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20finit_module%20-k%20module-change%0A - mode: 0600 - path: /etc/audit/rules.d/75-kernel-module-loading-finit.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading - init_module - To capture kernel module loading events, use following line, setting ARCH to -either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: - --a always,exit -F arch=ARCH -S init_module -F key=modules - - -Place to add the line depends on a way auditd daemon is configured. If it is configured -to use the augenrules program (the default), add the line to a file with suffix -.rules in the directory /etc/audit/rules.d. - -If the auditd daemon is configured to use the auditctl utility, -add the line to file /etc/audit/audit.rules. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.7 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-GPOS-00216 - SRG-OS-000477-GPOS-00222 - SRG-OS-000477-VMM-001970 - The addition of kernel modules can be used to alter the behavior of -the kernel and potentially introduce malicious code into kernel space. It is important -to have an audit trail of modules that have been introduced into the kernel. - - CCE-82582-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A - mode: 0600 - path: /etc/audit/rules.d/75-kernel-module-loading-init.rules - overwrite: true - - - - - - - - - - - Record Attempts to Alter Logon and Logout Events - The audit system already collects login information for all users -and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual -edits of files involved in storing logon events: --w /var/log/tallylog -p wa -k logins --w /var/run/faillock -p wa -k logins --w /var/log/lastlog -p wa -k logins -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file in order to watch for unattempted manual -edits of files involved in storing logon events: --w /var/log/tallylog -p wa -k logins --w /var/run/faillock -p wa -k logins --w /var/log/lastlog -p wa -k logins - - - Record Attempts to Alter Logon and Logout Events - The audit system already collects login information for all users -and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual -edits of files involved in storing logon events: --w /var/log/tallylog -p wa -k logins --w /var/run/faillock -p wa -k logins --w /var/log/lastlog -p wa -k logins -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file in order to watch for unattempted manual -edits of files involved in storing logon events: --w /var/log/tallylog -p wa -k logins --w /var/run/faillock -p wa -k logins --w /var/log/lastlog -p wa -k logins - This rule checks for multiple syscalls related to login events; -it was written with DISA STIG in mind. Other policies should use a -separate rule for each syscall that needs to be checked. For example: -audit_rules_login_events_tallylogaudit_rules_login_events_faillockaudit_rules_login_events_lastlog - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.2.3 - Manual editing of these files may indicate nefarious activity, such -as an attacker attempting to remove evidence of an intrusion. - - - - - - - Record Attempts to Alter Logon and Logout Events - faillock - The audit system already collects login information for all users -and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual -edits of files involved in storing logon events: --w /var/run/faillock -p wa -k logins -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file in order to watch for unattempted manual -edits of files involved in storing logon events: --w /var/run/faillock -p wa -k logins - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.3 - SRG-OS-000392-GPOS-00172 - SRG-OS-000470-GPOS-00214 - SRG-OS-000473-GPOS-00218 - SRG-OS-000473-VMM-001930 - SRG-OS-000470-VMM-001900 - Manual editing of these files may indicate nefarious activity, such -as an attacker attempting to remove evidence of an intrusion. - - CCE-82583-6 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/var/run/faillock%20-p%20wa%20-k%20logins%0A - mode: 0644 - path: /etc/audit/rules.d/75-faillock_login_events.rules - overwrite: true - - - - - - - - - - Record Attempts to Alter Logon and Logout Events - lastlog - The audit system already collects login information for all users -and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual -edits of files involved in storing logon events: --w /var/log/lastlog -p wa -k logins -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file in order to watch for unattempted manual -edits of files involved in storing logon events: --w /var/log/lastlog -p wa -k logins - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000126 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.3 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000473-GPOS-00218 - SRG-OS-000470-GPOS-00214 - SRG-OS-000473-VMM-001930 - SRG-OS-000470-VMM-001900 - Manual editing of these files may indicate nefarious activity, such -as an attacker attempting to remove evidence of an intrusion. - - CCE-82584-4 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/var/log/lastlog%20-p%20wa%20-k%20logins%0A - mode: 0644 - path: /etc/audit/rules.d/75-lastlog_login_events.rules - overwrite: true - - - - - - - - - - Record Attempts to Alter Logon and Logout Events - tallylog - The audit system already collects login information for all users -and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual -edits of files involved in storing logon events: --w /var/log/tallylog -p wa -k logins -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file in order to watch for unattempted manual -edits of files involved in storing logon events: --w /var/log/tallylog -p wa -k logins - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000172 - CCI-002884 - CCI-000126 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.2.3 - SRG-OS-000392-GPOS-00172 - SRG-OS-000470-GPOS-00214 - SRG-OS-000473-GPOS-00218 - SRG-OS-000473-VMM-001930 - SRG-OS-000470-VMM-001900 - Manual editing of these files may indicate nefarious activity, such -as an attacker attempting to remove evidence of an intrusion. - - CCE-82585-1 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-w%20/var/log/tallylog%20-p%20wa%20-k%20logins%0A - mode: 0644 - path: /etc/audit/rules.d/75-tallylog_login_events.rules - overwrite: true - - - - - - - - - - - Record Information on the Use of Privileged Commands - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. - - - Ensure auditd Collects Information on the Use of Privileged Commands - init - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/init -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/init -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - AU-12(c) - SRG-OS-000477-GPOS-00222 - Misuse of the init command may cause availability issues for the system. - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/init%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_init_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - poweroff - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/poweroff -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/poweroff -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - AU-12(c) - SRG-OS-000477-GPOS-00222 - Misuse of the poweroff command may cause availability issues for the system. - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/poweroff%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_poweroff_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - reboot - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/reboot -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/reboot -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - AU-12(c) - SRG-OS-000477-GPOS-00222 - Misuse of the reboot command may cause availability issues for the system. - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/reboot%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_reboot_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - shutdown - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/shutdown -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/shutdown -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - AU-12(c) - SRG-OS-000477-GPOS-00222 - Misuse of the shutdown command may cause availability issues for the system. - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/shutdown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_shutdown_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - The audit system should collect information about usage of privileged -commands for all users and root. To find the relevant setuid / -setgid programs, run the following command for each local partition -PART: -$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null -If the auditd daemon is configured to use the augenrules -program to read audit rules during daemon startup (the default), add a line of -the following form to a file with suffix .rules in the directory -/etc/audit/rules.d for each setuid / setgid program on the system, -replacing the SETUID_PROG_PATH part with the full path of that setuid / -setgid program in the list: --a always,exit -F path=SETUID_PROG_PATH -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules for each setuid / setgid program on the -system, replacing the SETUID_PROG_PATH part with the full path of that -setuid / setgid program in the list: --a always,exit -F path=SETUID_PROG_PATH -F auid>=1000 -F auid!=unset -F key=privileged - This rule checks for multiple syscalls related to privileged commands; -it was written with DISA STIG in mind. Other policies should use a -separate rule for each syscall that needs to be checked. For example: -audit_rules_privileged_commands_suaudit_rules_privileged_commands_umountaudit_rules_privileged_commands_passwd - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO08.04 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.05 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-002234 - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.5 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.3.4.5.9 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 3.9 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - 0582 - 0584 - 05885 - 0586 - 0846 - 0957 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.1 - A.16.1.2 - A.16.1.3 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.1.3 - A.6.2.1 - A.6.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-2 - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - DE.DP-4 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - RS.CO-2 - Req-10.2.2 - SRG-OS-000327-GPOS-00127 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82589-3 - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - at - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/at -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/at -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82590-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/at%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_at_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - chage - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000468-GPOS-00212 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82591-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/chage%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_chage_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - chsh - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82592-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/chsh%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_chsh_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - crontab - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82593-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/crontab%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_crontab_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82594-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/gpasswd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_gpasswd_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - mount - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82595-0 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/mount%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_mount_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82596-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/newgidmap%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_newgidmap_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newgrp - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000169 - CCI-000135 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82597-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/newgrp%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_newgrp_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82598-4 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/newuidmap%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_newuidmap_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/pam_timestamp_check --F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/pam_timestamp_check --F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82599-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/pam_timestamp_check%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_pam_timestamp_check_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - passwd - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82600-8 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_passwd_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - postdrop - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82601-6 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/postdrop%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_postdrop_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - postqueue - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82602-4 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/postqueue%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_postqueue_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/libexec/pt_chown -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/libexec/pt_chown -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000135 - CCI-000172 - CCI-002884 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000042-GPOS-00020 - SRG-OS-000392-GPOS-00172 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82603-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/libexec/pt_chown%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_libexec_pt_chown_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82604-0 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/libexec/openssh/ssh-keysign%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_libexec_openssh_ssh-keysign_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - su - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000064-GPOS-0003 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000466-GPOS-00210 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82605-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/su%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_su_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - sudo - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged - BP28(R19) - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000466-GPOS-00210 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82606-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/sudo%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_sudo_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82607-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/sudoedit%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_sudoedit_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - umount - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000169 - CCI-000135 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82608-1 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/bin/umount%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_bin_umount_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000130 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - CIP-007-3 R6.5 - AC-2(4) - AU-2(d) - AU-3 - AU-3.1 - AU-12(a) - AU-12(c) - AU-12.1(ii) - AU-12.1(iv) - AC-6(9) - CM-6(a) - MA-4(1)(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82609-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/unix_chkpwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_unix_chkpwd_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - userhelper - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=unset -F key=privileged - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-000135 - CCI-000169 - CCI-000172 - CCI-002884 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000037-GPOS-00015 - SRG-OS-000042-GPOS-00020 - SRG-OS-000062-GPOS-00031 - SRG-OS-000392-GPOS-00172 - SRG-OS-000462-GPOS-00206 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82610-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/userhelper%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_userhelper_execution.rules - overwrite: true - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: --a always,exit -F path=/usr/sbin/usernetctl -F auid>=1000 -F auid!=unset -F key=privileged -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: --a always,exit -F path=/usr/sbin/usernetctl -F auid>=1000 -F auid!=unset -F key=privileged - CCI-000172 - CIP-004-6 R2.2.2 - CIP-004-6 R2.2.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - AC-2(4) - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - FAU_GEN.1.1.c - SRG-OS-000471-VMM-001910 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. - -Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. - - CCE-82611-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,-a%20always%2Cexit%20-F%20path%3D/usr/sbin/usernetctl%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A - mode: 0644 - path: /etc/audit/rules.d/75-usr_sbin_usernetctl_execution.rules - overwrite: true - - - - - - - - - - - Records Events that Modify Date and Time Information - Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files, as well as to confuse network services that -are highly dependent upon an accurate system time. All changes to the system -time should be audited. - - - Record attempts to alter time through adjtimex - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules -The -k option allows for the specification of a key in string form that can be -used for better reporting capability through ausearch and aureport. Multiple -system calls can be defined on the same line to save space if desired, but is -not required. See an example of multiple combined syscalls: --a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-001487 - CCI-000169 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.4.2.b - Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files, as well as to confuse network services that -are highly dependent upon an accurate system time (such as sshd). All changes -to the system time should be audited. - - CCE-82614-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-syscall-adjtimex.rules - overwrite: true - - - - - - - - - - Record Attempts to Alter Time Through clock_settime - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change -The -k option allows for the specification of a key in string form that can -be used for better reporting capability through ausearch and aureport. -Multiple system calls can be defined on the same line to save space if -desired, but is not required. See an example of multiple combined syscalls: --a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-001487 - CCI-000169 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.4.2.b - Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files, as well as to confuse network services that -are highly dependent upon an accurate system time (such as sshd). All changes -to the system time should be audited. - - CCE-82615-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-syscall-clock-settime.rules - overwrite: true - - - - - - - - - - Record attempts to alter time through settimeofday - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d: --a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules -If the system is 64 bit then also add the following line: --a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules -The -k option allows for the specification of a key in string form that can be -used for better reporting capability through ausearch and aureport. Multiple -system calls can be defined on the same line to save space if desired, but is -not required. See an example of multiple combined syscalls: --a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-001487 - CCI-000169 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.4.2.b - Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files, as well as to confuse network services that -are highly dependent upon an accurate system time (such as sshd). All changes -to the system time should be audited. - - CCE-82616-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20settimeofday%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20settimeofday%20-k%20audit_time_rules%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-syscall-settimeofday.rules - overwrite: true - - - - - - - - - - Record Attempts to Alter Time Through stime - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following line to a file with suffix .rules in the -directory /etc/audit/rules.d for both 32 bit and 64 bit systems: --a always,exit -F arch=b32 -S stime -F key=audit_time_rules -Since the 64 bit version of the "stime" system call is not defined in the audit -lookup table, the corresponding "-F arch=b64" form of this rule is not expected -to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule -form itself is sufficient for both 32 bit and 64 bit systems). If the -auditd daemon is configured to use the auditctl utility to -read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file for both 32 bit and 64 bit systems: --a always,exit -F arch=b32 -S stime -F key=audit_time_rules -Since the 64 bit version of the "stime" system call is not defined in the audit -lookup table, the corresponding "-F arch=b64" form of this rule is not expected -to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule -form itself is sufficient for both 32 bit and 64 bit systems). The -k option -allows for the specification of a key in string form that can be used for -better reporting capability through ausearch and aureport. Multiple system -calls can be defined on the same line to save space if desired, but is not -required. See an example of multiple combined system calls: --a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-001487 - CCI-000169 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.4.2.b - Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files, as well as to confuse network services that -are highly dependent upon an accurate system time (such as sshd). All changes -to the system time should be audited. - - CCE-82617-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20stime%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20stime%20-k%20audit_time_rules%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-syscall-stime.rules - overwrite: true - - - - - - - - - - Record Attempts to Alter the localtime File - If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the default), -add the following line to a file with suffix .rules in the directory -/etc/audit/rules.d: --w /etc/localtime -p wa -k audit_time_rules -If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following line to -/etc/audit/audit.rules file: --w /etc/localtime -p wa -k audit_time_rules -The -k option allows for the specification of a key in string form that can -be used for better reporting capability through ausearch and aureport and -should always be used. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 5.4.1.1 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI08.02 - DSS01.03 - DSS01.04 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.1.7 - CCI-001487 - CCI-000169 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.2.3.10 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.3.6.6 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.13 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.6 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.6.2.1 - A.6.2.2 - AU-2(d) - AU-12(c) - AC-6(9) - CM-6(a) - DE.AE-3 - DE.AE-5 - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.AC-3 - PR.PT-1 - PR.PT-4 - RS.AN-1 - RS.AN-4 - Req-10.4.2.b - Arbitrary changes to the system time can be used to obfuscate -nefarious activities in log files, as well as to confuse network services that -are highly dependent upon an accurate system time (such as sshd). All changes -to the system time should be audited. - - CCE-82618-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ -w%20/etc/localtime%20-p%20wa%20-k%20audit_time_rules%0A }} - mode: 0600 - path: /etc/audit/rules.d/75-etclocaltime-wa-audit_time_rules.rules - overwrite: true - - - - - - - - - - - - Configure auditd Data Retention - The audit system writes data to /var/log/audit/audit.log. By default, -auditd rotates 5 logs by size (6MB), retaining a maximum of 30MB of -data in total, and refuses to write entries when the disk is too -full. This minimizes the risk of audit data filling its partition -and impacting other services. This also minimizes the risk of the audit -daemon temporarily disabling the system if it cannot write audit log (which -it can be configured to do). - -For a busy -system or a system which is thoroughly auditing system activity, the default settings -for data retention may be - insufficient. The log file size needed will depend heavily on what types -of events are being audited. First configure auditing to log all the events of -interest. Then monitor the log size manually for awhile to determine what file -size will allow you to keep the required data for the correct time period. - -Using a dedicated partition for /var/log/audit prevents the -auditd logs from disrupting system functionality if they fill, and, -more importantly, prevents other activity in /var from filling the -partition and stopping the audit trail. (The audit logs are size-limited and -therefore unlikely to grow without bound unless configured to do so.) Some -machines may have requirements that no actions occur which cannot be audited. -If this is the case, then auditd can be configured to halt the machine -if it runs out of space. Note: Since older logs are rotated, -configuring auditd this way does not prevent older logs from being -rotated away before they can be viewed. - -If your system is configured to halt when logging cannot be performed, make -sure this can never happen under normal circumstances! Ensure that -/var/log/audit is on its own partition, and that this partition is -larger than the maximum amount of data auditd will retain -normally. - - - Action for audispd to take when disk is full - The setting for disk_full_action in /etc/audisp/audisp-remote.conf - single - exec - halt - single - suspend - syslog - warn_once - stop - - - Action for audispd to take when network fails - The setting for network_failure_action in /etc/audisp/audisp-remote.conf - single - exec - halt - single - suspend - syslog - warn_once - stop - ignore - - - Remote server for audispd to send audit records - -The setting for remote_server in /etc/audisp/audisp-remote.conf - logcollector - - - Account for auditd to send email when actions occurs - The setting for action_mail_acct in /etc/audit/auditd.conf - admin - root - root - - - Action for auditd to take when disk space is low - The setting for admin_space_left_action in /etc/audit/auditd.conf - single - email - exec - halt - single - suspend - syslog - rotate - ignore - - - Action for auditd to take when disk errors - 'The setting for disk_error_action in /etc/audit/auditd.conf, if multiple -values are allowed write them separated by pipes as in "syslog|single|halt", -for remediations the first value will be taken' - single - exec - halt - single - suspend - syslog - ignore - syslog|single|halt - syslog|single|halt - - - Action for auditd to take when disk is full - 'The setting for disk_full_action in /etc/audit/auditd.conf, if multiple -values are allowed write them separated by pipes as in "syslog|single|halt", -for remediations the first value will be taken' - single - exec - halt - single - suspend - syslog - ignore - rotate - syslog|single|halt - syslog|single|halt - - - Auditd priority for flushing data to disk - The setting for flush in /etc/audit/auditd.conf - data - data - incremental - incremental_async - none - sync - - - Maximum audit log file size for auditd - The setting for max_log_file in /etc/audit/auditd.conf - 1 - 10 - 20 - 5 - 6 - 6 - - - Action for auditd to take when log files reach their maximum size - The setting for max_log_file_action in /etc/audit/auditd.conf. The following options are available: -ignore - audit daemon does nothing. -syslog - audit daemon will issue a warning to syslog. -suspend - audit daemon will stop writing records to the disk. -rotate - audit daemon will rotate logs in the same convention used by logrotate. -keep_logs - similar to rotate but prevents audit logs to be overwritten. May trigger space_left_action if volume is full. - rotate - keep_logs - rotate - suspend - syslog - ignore - - - Number of log files for auditd to retain - The setting for num_logs in /etc/audit/auditd.conf - 0 - 1 - 2 - 3 - 4 - 5 - 10 - 20 - 50 - 100 - 5 - - - Size remaining in disk space before prompting space_left_action - The setting for space_left (MB) in /etc/audit/auditd.conf - 1000 - 100 - 250 - 500 - 750 - 100 - - - Action for auditd to take when disk space just starts to run low - The setting for space_left_action in /etc/audit/auditd.conf - email - email - exec - halt - single - suspend - syslog - rotate - ignore - - - The percentage remaining in disk space before prompting space_left_action - The setting for space_left as a percentage in /etc/audit/auditd.conf - 25 - 50 - 75 - 25 - - - Configure audispd Plugin To Send Logs To Remote Server - Configure the audispd plugin to off-load audit records onto a different -system or media from the system being audited. - -Set the remote_server option in /etc/audit/audisp-remote.conf -with an IP address or hostname of the system that the audispd plugin should -send audit records to. For example -remote_server = - CCI-001851 - FAU_GEN.1.1.c - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - SRG-OS-000051-VMM-000230 - SRG-OS-000058-VMM-000270 - SRG-OS-000059-VMM-000280 - SRG-OS-000479-VMM-001990 - SRG-OS-000479-VMM-001990 - Information stored in one location is vulnerable to accidental or incidental -deletion or alteration.Off-loading is a common process in information systems -with limited audit storage capacity. - - - - - - - - - - - Configure audispd's Plugin disk_full_action When Disk Is Full - Configure the action the operating system takes if the disk the audit records -are written to becomes full. Edit the file /etc/audit/audisp-remote.conf. -Add or modify the following line, substituting ACTION appropriately: -disk_full_action = ACTION -Set this value to single to cause the system to switch to single user -mode for corrective action. Acceptable values also include syslog and -halt. For certain systems, the need for availability -outweighs the need to log all actions, and a different setting should be -determined. - CCI-001851 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - Taking appropriate action in case of a filled audit storage volume will -minimize the possibility of losing audit records. - - - - - - - - - - - Encrypt Audit Records Sent With audispd Plugin - Configure the operating system to encrypt the transfer of off-loaded audit -records onto a different system or media from the system being audited. - -Uncomment the enable_krb5 option in /etc/audit/audisp-remote.conf, -and set it with the following line: -enable_krb5 = yes - CCI-001851 - AU-9(3) - CM-6(a) - FAU_GEN.1.1.c - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - Information stored in one location is vulnerable to accidental or incidental deletion -or alteration. Off-loading is a common process in information systems with limited -audit storage capacity. - - - - - - - - - - Configure audispd's Plugin network_failure_action On Network Failure - Configure the action the operating system takes if there is an error sending -audit records to a remote system. Edit the file /etc/audit/audisp-remote.conf. -Add or modify the following line, substituting ACTION appropriately: -network_failure_action = ACTION -Set this value to single to cause the system to switch to single user -mode for corrective action. Acceptable values also include syslog and -halt. For certain systems, the need for availability -outweighs the need to log all actions, and a different setting should be -determined. -This profile configures the action to be . - CCI-001851 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - Taking appropriate action when there is an error sending audit records to a -remote system will minimize the possibility of losing audit records. - - - - - - - - - - - Configure auditd to use audispd's syslog plugin - To configure the auditd service to use the -syslog plug-in of the audispd audit event multiplexor, set -the active line in /etc/audit/plugins.d/syslog.conf to yes. -Restart the auditd service: -$ sudo service auditd restart - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - 3.3.1 - CCI-000136 - 164.308(a)(1)(ii)(D) - 164.308(a)(5)(ii)(B) - 164.308(a)(5)(ii)(C) - 164.308(a)(6)(ii) - 164.308(a)(8) - 164.310(d)(2)(iii) - 164.312(b) - 164.314(a)(2)(i)(C) - 164.314(a)(2)(iii) - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - AU-4(1) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - FAU_GEN.1.1.c - Req-10.5.3 - SRG-OS-000479-GPOS-00224 - SRG-OS-000342-GPOS-00133 - SRG-OS-000051-VMM-000230 - SRG-OS-000058-VMM-000270 - SRG-OS-000059-VMM-000280 - SRG-OS-000479-VMM-001990 - SRG-OS-000479-VMM-001990 - The auditd service does not include the ability to send audit -records to a centralized server for management directly. It does, however, -include a plug-in for audit event multiplexor (audispd) to pass audit records -to the local syslog server. - - - - - - - - - - Configure auditd Disk Error Action on Disk Error - The auditd service can be configured to take an action -when there is a disk error. -Edit the file /etc/audit/auditd.conf. Add or modify the following line, -substituting ACTION appropriately: -disk_error_action = ACTION -Set this value to single to cause the system to switch to single-user -mode for corrective action. Acceptable values also include syslog, -exec, single, and halt. For certain systems, the need for availability -outweighs the need to log all actions, and a different setting should be -determined. Details regarding all possible values for ACTION are described in the -auditd.conf man page. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000140 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - SRG-OS-000047-GPOS-00023 - Taking appropriate action in case of disk errors will minimize the possibility of -losing audit records. - - CCE-82679-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd Disk Error Action on Disk Error - The auditd service can be configured to take an action -when there is a disk error. -Edit the file /etc/audit/auditd.conf. Add or modify the following line, -substituting ACTION appropriately: -disk_error_action = ACTION -Set this value to single to cause the system to switch to single-user -mode for corrective action. Acceptable values also include syslog, -exec, single, and halt. For certain systems, the need for availability -outweighs the need to log all actions, and a different setting should be -determined. Details regarding all possible values for ACTION are described in the -auditd.conf man page. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000140 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - SRG-OS-000047-GPOS-00023 - Taking appropriate action in case of disk errors will minimize the possibility of -losing audit records. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - Configure auditd Disk Full Action when Disk Space Is Full - The auditd service can be configured to take an action -when disk space is running low but prior to running out of space completely. -Edit the file /etc/audit/auditd.conf. Add or modify the following line, -substituting ACTION appropriately: -disk_full_action = ACTION -Set this value to single to cause the system to switch to single-user -mode for corrective action. Acceptable values also include syslog, - -exec, - -single, and halt. For certain systems, the need for availability -outweighs the need to log all actions, and a different setting should be -determined. Details regarding all possible values for ACTION are described in the -auditd.conf man page. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000140 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - SRG-OS-000047-GPOS-00023 - Taking appropriate action in case of a filled audit storage volume will minimize -the possibility of losing audit records. - - CCE-82676-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd Disk Full Action when Disk Space Is Full - The auditd service can be configured to take an action -when disk space is running low but prior to running out of space completely. -Edit the file /etc/audit/auditd.conf. Add or modify the following line, -substituting ACTION appropriately: -disk_full_action = ACTION -Set this value to single to cause the system to switch to single-user -mode for corrective action. Acceptable values also include syslog, -single, and halt. For certain systems, the need for availability -outweighs the need to log all actions, and a different setting should be -determined. Details regarding all possible values for ACTION are described in the -auditd.conf man page. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000140 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - SRG-OS-000047-GPOS-00023 - Taking appropriate action in case of a filled audit storage volume will minimize -the possibility of losing audit records. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - Configure auditd mail_acct Action on Low Disk Space - The auditd service can be configured to send email to -a designated account in certain situations. Add or correct the following line -in /etc/audit/auditd.conf to ensure that administrators are notified -via email for those situations: -action_mail_acct = - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - 3.3.1 - CCI-000139 - CCI-001855 - 164.312(a)(2)(ii) - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - CIP-003-8 R1.3 - CIP-003-8 R3 - CIP-003-8 R3.1 - CIP-003-8 R3.2 - CIP-003-8 R3.3 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - IA-5(1) - AU-5(a) - AU-5(2) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7.a - SRG-OS-000046-GPOS-00022 - SRG-OS-000343-GPOS-00134 - SRG-OS-000046-VMM-000210 - SRG-OS-000343-VMM-001240 - Email sent to the root account is typically aliased to the -administrators of the system, who can take appropriate action. - - CCE-82675-0 - - - - - - - - - - Configure auditd admin_space_left Action on Low Disk Space - The auditd service can be configured to take an action -when disk space is running low but prior to running out of space completely. -Edit the file /etc/audit/auditd.conf. Add or modify the following line, -substituting ACTION appropriately: -admin_space_left_action = ACTION -Set this value to single to cause the system to switch to single user -mode for corrective action. Acceptable values also include suspend and -halt. For certain systems, the need for availability -outweighs the need to log all actions, and a different setting should be -determined. Details regarding all possible values for ACTION are described in the -auditd.conf man page. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - 3.3.1 - CCI-000140 - CCI-001343 - CCI-001855 - 164.312(a)(2)(ii) - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7 - SRG-OS-000343-GPOS-00134 - Administrators should be made aware of an inability to record -audit records. If a separate partition or logical volume of adequate size -is used, running low on space for audit records should never occur. - - CCE-82677-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd flush priority - The auditd service can be configured to -synchronously write audit event data to disk. Add or correct the following -line in /etc/audit/auditd.conf to ensure that audit event data is -fully synchronized with the log files on the disk: -flush = - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - BAI03.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - 3.3.1 - CCI-001576 - 164.308(a)(1)(ii)(D) - 164.308(a)(3)(ii)(A) - 164.308(a)(5)(ii)(C) - 164.312(a)(2)(i) - 164.312(b) - 164.312(d) - 164.312(e) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - CIP-004-6 R2.2.3 - CIP-004-6 R3.3 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - CIP-007-3 R6.5 - AU-11 - CM-6(a) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.PT-1 - SRG-OS-000480-GPOS-00227 - Audit data should be synchronously written to disk to ensure -log integrity. These parameters assure that all audit event data is fully -synchronized with the log files on the disk. - - CCE-82508-3 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd Max Log File Size - Determine the amount of audit data (in megabytes) -which should be retained in each log file. Edit the file -/etc/audit/auditd.conf. Add or modify the following line, substituting -the correct value of for STOREMB: -max_log_file = STOREMB -Set the value to 6 (MB) or higher for general-purpose systems. -Larger values, of course, -support retention of even more audit data. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - CIP-004-6 R2.2.3 - CIP-004-6 R3.3 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - CIP-007-3 R6.5 - AU-11 - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7 - The total storage for audit log files must be large enough to retain -log information over the period required. This is a function of the maximum -log file size and the number of logs retained. - - CCE-82694-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd max_log_file_action Upon Reaching Maximum Log Size - The default action to take when the logs reach their maximum size -is to rotate the log files, discarding the oldest one. To configure the action taken -by auditd, add or correct the line in /etc/audit/auditd.conf: -max_log_file_action = ACTION -Possible values for ACTION are described in the auditd.conf man -page. These include: -ignoresyslogsuspendrotatekeep_logs -Set the ACTION to rotate to ensure log rotation -occurs. This is the default. The setting is case-insensitive. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000140 - 164.312(a)(2)(ii) - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7 - SRG-OS-000047-GPOS-00023 - Automatically rotating logs (by setting this to rotate) -minimizes the chances of the system unexpectedly running out of disk space by -being overwhelmed with log data. However, for systems that must never discard -log data, or which use external processes to transfer it and reclaim space, -keep_logs can be employed. - - CCE-82680-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd max_log_file_action Upon Reaching Maximum Log Size - The default action to take when the logs reach their maximum size -is to rotate the log files, discarding the oldest one. To configure the action taken -by auditd, add or correct the line in /etc/audit/auditd.conf: -max_log_file_action = ACTION -Possible values for ACTION are described in the auditd.conf man -page. These include: -ignoresyslogsuspendrotatekeep_logs -Set the ACTION to rotate to ensure log rotation -occurs. This is the default. The setting is case-insensitive. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000140 - 164.312(a)(2)(ii) - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7 - SRG-OS-000047-GPOS-00023 - Automatically rotating logs (by setting this to rotate) -minimizes the chances of the system unexpectedly running out of disk space by -being overwhelmed with log data. However, for systems that must never discard -log data, or which use external processes to transfer it and reclaim space, -keep_logs can be employed. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - Configure auditd Number of Logs Retained - Determine how many log files -auditd should retain when it rotates logs. -Edit the file /etc/audit/auditd.conf. Add or modify the following -line, substituting NUMLOGS with the correct value of : -num_logs = NUMLOGS -Set the value to 5 for general-purpose systems. -Note that values less than 2 result in no log rotation. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO11.04 - APO12.06 - BAI03.05 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - 3.3.1 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - CIP-004-6 R2.2.3 - CIP-004-6 R3.3 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - CIP-007-3 R6.5 - AU-11 - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7 - The total storage for audit log files must be large enough to retain -log information over the period required. This is a function of the maximum log -file size and the number of logs retained. - - CCE-82693-3 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd space_left on Low Disk Space - The auditd service can be configured to take an action -when disk space is running low but prior to running out of space completely. -Edit the file /etc/audit/auditd.conf. Add or modify the following line, -substituting SIZE_in_MB appropriately: -space_left = SIZE_in_MB -Set this value to the appropriate size in Megabytes cause the system to -notify the user of an issue. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-001855 - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7 - SRG-OS-000343-GPOS-00134 - SRG-OS-000343-VMM-001240 - Notifying administrators of an impending disk space problem may allow them to -take corrective action prior to any disruption. - - CCE-82681-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Configure auditd space_left Action on Low Disk Space - The auditd service can be configured to take an action -when disk space starts to run low. -Edit the file /etc/audit/auditd.conf. Modify the following line, -substituting ACTION appropriately: -space_left_action = ACTION -Possible values for ACTION are described in the auditd.conf man page. -These include: -syslogemailexecsuspendsinglehalt -Set this to email (instead of the default, -which is suspend) as it is more likely to get prompt attention. Acceptable values -also include suspend, single, and halt. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 19 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 5.4.1.1 - APO11.04 - APO12.06 - APO13.01 - BAI03.05 - BAI04.04 - BAI08.02 - DSS02.02 - DSS02.04 - DSS02.07 - DSS03.01 - DSS05.04 - DSS05.07 - MEA02.01 - 3.3.1 - CCI-001855 - 164.312(a)(2)(ii) - 4.2.3.10 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.3.4.5.6 - 4.3.4.5.7 - 4.3.4.5.8 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.16.1.4 - A.16.1.5 - A.16.1.7 - A.17.2.1 - AU-5(b) - AU-5(2) - AU-5(1) - AU-5(4) - CM-6(a) - DE.AE-3 - DE.AE-5 - PR.DS-4 - PR.PT-1 - RS.AN-1 - RS.AN-4 - Req-10.7 - SRG-OS-000343-GPOS-00134 - SRG-OS-000343-VMM-001240 - Notifying administrators of an impending disk space problem may -allow them to take corrective action prior to any disruption. - - CCE-82678-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - Set number of records to cause an explicit flush to audit logs - To configure Audit daemon to issue an explicit flush to disk command -after writing 50 records, set freq to 50 -in /etc/audit/auditd.conf. - CM-6 - FAU_GEN.1 - SRG-OS-000051-GPOS-00024 - If option freq isn't set to 50, the flush to disk -may happen after higher number of records, increasing the danger -of audit loss. - - CCE-82512-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - Include Local Events in Audit Logs - To configure Audit daemon to include local events in Audit logs, set -local_events to yes in /etc/audit/auditd.conf. -This is the default setting. - CCI-000366 - CM-6 - FAU_GEN.1 - SRG-OS-000062-GPOS-00031 - SRG-OS-000480-GPOS-00227 - If option local_events isn't set to yes only events from -network will be aggregated. - - CCE-82509-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - Resolve information before writing to audit logs - To configure Audit daemon to resolve all uid, gid, syscall, -architecture, and socket address information before writing the -events to disk, set log_format to ENRICHED -in /etc/audit/auditd.conf. - CCI-000366 - CM-6 - AU-3 - FAU_GEN.1.2 - SRG-OS-000255-GPOS-00096 - SRG-OS-000480-GPOS-00227 - If option log_format isn't set to ENRICHED, the -audit records will be stored in a format exactly as the kernel sends them. - - CCE-82511-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - Set hostname as computer node name in audit logs - To configure Audit daemon to use value returned by gethostname -syscall as computer node name in the audit events, -set name_format to hostname -in /etc/audit/auditd.conf. - CCI-001851 - CM-6 - AU-3 - FAU_GEN.1.2 - SRG-OS-000039-GPOS-00017 - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - If option name_format is left at its default value of -none, audit events from different computers may be hard -to distinguish. - - CCE-82513-3 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - Appropriate Action Must be Setup When the Internal Audit Event Queue is Full - The audit system should have an action setup in the event the internal event queue becomes full. -To setup an overflow action edit /etc/audit/auditd.conf. Set overflow_action -to one of the following values: syslog, single, halt. - CCI-001851 - AU-4(1) - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - The audit system should have an action setup in the event the internal event queue becomes full -so that no data is lost. - - - - - - - - - - Write Audit Logs to the Disk - To configure Audit daemon to write Audit logs to the disk, set -write_logs to yes in /etc/audit/auditd.conf. -This is the default setting. - CM-6 - FAU_STG.1 - SRG-OS-000480-GPOS-00227 - If write_logs isn't set to yes, the Audit logs will -not be written to the disk. - - CCE-82510-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }} - mode: 0640 - path: /etc/audit/auditd.conf - overwrite: true - - - - - - - - - - - System Accounting with auditd - The auditd program can perform comprehensive -monitoring of system activity. This section makes use of recommended -configuration settings for specific policies or use cases. -The rules in this section make use of rules defined in /usr/share/doc/audit-VERSION/rules. - - - Configure auditing of unsuccessful file accesses - Ensure that unsuccessful attempts to access a file are audited. - -The following rules configure audit as described above: -## Unsuccessful file access (any other opens) This has to go last. --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - 0582 - 0584 - 05885 - 0586 - 0846 - 0957 - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20Unsuccessful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EACCES%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-access%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Copenat%2Copen_by_handle_at%20-F%20exit%3D-EPERM%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-access - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules - overwrite: true - - - - - - - - - - Configure auditing of successful file accesses - Ensure that successful attempts to access a file are audited. - -The following rules configure audit as described above: -## Successful file access (any other opens) This has to go last. -## These next two are likely to result in a whole lot of events --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - 0582 - 0584 - 05885 - 0586 - 0846 - 0957 - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - Auditing of successful attempts to access a file helps in investigation of activities performed on the system. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20Successful%20file%20access%20%28any%20other%20opens%29%20This%20has%20to%20go%20last.%0A%23%23%20These%20next%20two%20are%20likely%20to%20result%20in%20a%20whole%20lot%20of%20events%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%2Copenat%2Copen_by_handle_at%20-F%20success%3D1%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsuccessful-access%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%2Copenat%2Copen_by_handle_at%20-F%20success%3D1%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsuccessful-access - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-3-access-success.rules - overwrite: true - - - - - - - - - - Configure basic parameters of Audit system - Perform basic configuration of Audit system. -Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, messages are configured to be directed to system log. - -The following rules configure audit as described above: -## First rule - delete all --D - -## Increase the buffers to survive stress events. -## Make this bigger for busy systems --b 8192 - -## This determine how long to wait in burst of events ---backlog_wait_time 60000 - -## Set failure mode to syslog --f 1 - -Load new Audit rules into kernel by running: -augenrules --load - It might happen that Audit buffer configured by this rule is not large enough for certain use cases. If that is the case, the buffer size can be overridden by placing -b larger_buffer_size into a file within /etc/audit/rules.d directory, replacing larger_file_size with the desired value. The file name should start with a number higher than 10 and lower than 99. - AU-2(a) - FAU_GEN.1 - SRG-OS-000365-GPOS-00152 - SRG-OS-000475-GPOS-00220 - Without basic configurations, audit may not perform as expected. It may not be able to correctly handle events under stressful conditions, or log events in case of failure. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20First%20rule%20-%20delete%20all%0A-D%0A%0A%23%23%20Increase%20the%20buffers%20to%20survive%20stress%20events.%0A%23%23%20Make%20this%20bigger%20for%20busy%20systems%0A-b%208192%0A%0A%23%23%20This%20determine%20how%20long%20to%20wait%20in%20burst%20of%20events%0A--backlog_wait_time%2060000%0A%0A%23%23%20Set%20failure%20mode%20to%20syslog%0A-f%201%0A - mode: 0600 - path: /etc/audit/rules.d/10-base-config.rules - overwrite: true - - - - - - - - - - Configure auditing of unsuccessful file creations - Ensure that unsuccessful attempts to create a file are audited. - -The following rules configure audit as described above: -## Unsuccessful file creation (open with O_CREAT) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions. - - - - - - - - - - Configure auditing of successful file creations - Ensure that successful attempts to create a file are audited. - -The following rules configure audit as described above: -## Successful file creation (open with O_CREAT) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - Auditing of successful attempts to create a file helps in investigation of actions which happened on the system. - - - - - - - - - - Configure auditing of unsuccessful file deletions - Ensure that unsuccessful attempts to delete a file are audited. - -The following rules configure audit as described above: -## Unsuccessful file delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - SRG-OS-000468-GPOS-00212 - Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20Unsuccessful%20file%20delete%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20exit%3D-EACCES%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-delete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20exit%3D-EACCES%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-delete%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20exit%3D-EPERM%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-delete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20exit%3D-EPERM%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-delete - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules - overwrite: true - - - - - - - - - - Configure auditing of successful file deletions - Ensure that successful attempts to delete a file are audited. - -The following rules configure audit as described above: -## Successful file delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - SRG-OS-000468-GPOS-00212 - Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system. - - --- - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%23%20Successful%20file%20delete%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20success%3D1%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsuccessful-delete%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20unlink%2Cunlinkat%2Crename%2Crenameat%20-F%20success%3D1%20-F%20auid%26gt%3B%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsuccessful-delete }} - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules - overwrite: true - - - - - - - - - - Configure immutable Audit login UIDs - Configure kernel to prevent modification of login UIDs once they are set. -Changing login UIDs while this configuration is enforced requires special capabilities which -are not available to unprivileged users. - -The following rules configure audit as described above: -## Make the loginuid immutable. This prevents tampering with the auid. ---loginuid-immutable - -Load new Audit rules into kernel by running: -augenrules --load - CCI-000162 - CCI-000163 - CCI-000164 - AU-2(a) - FAU_GEN.1.2 - SRG-OS-000462-GPOS-00206 - SRG-OS-000475-GPOS-00220 - SRG-OS-000057-GPOS-00027 - SRG-OS-000058-GPOS-00028 - SRG-OS-000059-GPOS-00029 - If modification of login UIDs is not prevented, they can be changed by unprivileged users and -make auditing complicated or impossible. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20Make%20the%20loginuid%20immutable.%20This%20prevents%20tampering%20with%20the%20auid.%0A--loginuid-immutable - mode: 0600 - path: /etc/audit/rules.d/11-loginuid.rules - overwrite: true - - - - - - - - - - Configure auditing of unsuccessful file modifications - Ensure that unsuccessful attempts to modify a file are audited. - -The following rules configure audit as described above: -## Unsuccessful file modifications (open for write or truncate) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20Unsuccessful%20file%20modifications%20%28open%20for%20write%20or%20truncate%29%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EACCES%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2601003%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20truncate%2Cftruncate%20-F%20exit%3D-EPERM%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dunsuccessful-modification%0A - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules - overwrite: true - - - - - - - - - - Configure auditing of successful file modifications - Ensure that successful attempts to modify a file are audited. - -The following rules configure audit as described above: -## Successful file modifications (open for write or truncate) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000458-GPOS-00203 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000461-GPOS-00205 - Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system. - - - - - - - - - - Configure auditing of loading and unloading of kernel modules - Ensure that loading and unloading of kernel modules is audited. - -The following rules configure audit as described above: -## These rules watch for kernel module insertion. By monitoring -## the syscall, we do not need any watches on programs. --a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load --a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load --a always,exit -F arch=b32 -S delete_module -F key=module-unload --a always,exit -F arch=b64 -S delete_module -F key=module-unload - -Load new Audit rules into kernel by running: -augenrules --load - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000471-GPOS-00216 - SRG-OS-000477-GPOS-00222 - SRG-OS-000475-GPOS-00220 - Loading of a malicious kernel module introduces a risk to the system, as the module has access to sensitive data and perform actions at the operating system kernel level. Having such events audited helps in monitoring and investigating of malicious activities. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20These%20rules%20watch%20for%20kernel%20module%20insertion.%20By%20monitoring%0A%23%23%20the%20syscall%2C%20we%20do%20not%20need%20any%20watches%20on%20programs.%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%2Cfinit_module%20-F%20key%3Dmodule-load%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%2Cfinit_module%20-F%20key%3Dmodule-load%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-F%20key%3Dmodule-unload%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-F%20key%3Dmodule-unload%0A - mode: 0600 - path: /etc/audit/rules.d/43-module-load.rules - overwrite: true - - - - - - - - - - Perform general configuration of Audit for OSPP - Configure some basic Audit parameters specific for OSPP profile. -In particular, configure Audit to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration. -Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls. - -The following rules configure audit as described above: -## The purpose of these rules is to meet the requirements for Operating -## System Protection Profile (OSPP)v4.2. These rules depends on having -## the following rule files copied to /etc/audit/rules.d: -## -## 10-base-config.rules, 11-loginuid.rules, -## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, -## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, -## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, -## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, -## 30-ospp-v42-5-perm-change-failed.rules, -## 30-ospp-v42-5-perm-change-success.rules, -## 30-ospp-v42-6-owner-change-failed.rules, -## 30-ospp-v42-6-owner-change-success.rules -## -## original copies may be found in /usr/share/audit/sample-rules/ - - -## User add delete modify. This is covered by pam. However, someone could -## open a file and directly create or modify a user, so we'll watch passwd and -## shadow for writes --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - -## User enable and disable. This is entirely handled by pam. - -## Group add delete modify. This is covered by pam. However, someone could -## open a file and directly create or modify a user, so we'll watch group and -## gshadow for writes --a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify --a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify - - -## Use of special rights for config changes. This would be use of setuid -## programs that relate to user accts. This is not all setuid apps because -## requirements are only for ones that affect system configuration. --a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes - -## Privilege escalation via su or sudo. This is entirely handled by pam. - -## Watch for configuration changes to privilege escalation. --a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes --a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes - -## Audit log access --a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -## Attempts to Alter Process and Session Initiation Information --a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session --a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session --a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session - -## Attempts to modify MAC controls --a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy - -## Software updates. This is entirely handled by rpm. - -## System start and shutdown. This is entirely handled by systemd - -## Kernel Module loading. This is handled in 43-module-load.rules - -## Application invocation. The requirements list an optional requirement -## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to -## state results from that policy. This would be handled entirely by -## that daemon. - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000004-GPOS-00004 - SRG-OS-000241-GPOS-00091 - SRG-OS-000476-GPOS-00221 - SRG-OS-000327-GPOS-00127 - SRG-OS-000475-GPOS-00220 - SRG-OS-000239-GPOS-00089 - SRG-OS-000274-GPOS-00104 - SRG-OS-000275-GPOS-00105 - SRG-OS-000303-GPOS-00120 - SRG-OS-000304-GPOS-00121 - Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with Audit logs, malicious access to files storing information about system users and groups etc. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%23%20The%20purpose%20of%20these%20rules%20is%20to%20meet%20the%20requirements%20for%20Operating%0A%23%23%20System%20Protection%20Profile%20%28OSPP%29v4.2.%20These%20rules%20depends%20on%20having%0A%23%23%20the%20following%20rule%20files%20copied%20to%20/etc/audit/rules.d%3A%0A%23%23%0A%23%23%2010-base-config.rules%2C%2011-loginuid.rules%2C%0A%23%23%2030-ospp-v42-1-create-failed.rules%2C%2030-ospp-v42-1-create-success.rules%2C%0A%23%23%2030-ospp-v42-2-modify-failed.rules%2C%2030-ospp-v42-2-modify-success.rules%2C%0A%23%23%2030-ospp-v42-3-access-failed.rules%2C%2030-ospp-v42-3-access-success.rules%2C%0A%23%23%2030-ospp-v42-4-delete-failed.rules%2C%2030-ospp-v42-4-delete-success.rules%2C%0A%23%23%2030-ospp-v42-5-perm-change-failed.rules%2C%0A%23%23%2030-ospp-v42-5-perm-change-success.rules%2C%0A%23%23%2030-ospp-v42-6-owner-change-failed.rules%2C%0A%23%23%2030-ospp-v42-6-owner-change-success.rules%0A%23%23%0A%23%23%20original%20copies%20may%20be%20found%20in%20/usr/share/audit/sample-rules/%0A%0A%0A%23%23%20User%20add%20delete%20modify.%20This%20is%20covered%20by%20pam.%20However%2C%20someone%20could%0A%23%23%20open%20a%20file%20and%20directly%20create%20or%20modify%20a%20user%2C%20so%20we%27ll%20watch%20passwd%20and%0A%23%23%20shadow%20for%20writes%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/passwd%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20openat%2Copen_by_handle_at%20-F%20a2%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20open%20-F%20a1%2603%20-F%20path%3D/etc/shadow%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A%0A%23%23%20User%20enable%20and%20disable.%20This%20is%20entirely%20handled%20by%20pam.%0A%0A%23%23%20Group%20add%20delete%20modify.%20This%20is%20covered%20by%20pam.%20However%2C%20someone%20could%0A%23%23%20open%20a%20file%20and%20directly%20create%20or%20modify%20a%20user%2C%20so%20we%27ll%20watch%20group%20and%0A%23%23%20gshadow%20for%20writes%0A-a%20always%2Cexit%20-F%20path%3D/etc/passwd%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20path%3D/etc/shadow%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Duser-modify%0A-a%20always%2Cexit%20-F%20path%3D/etc/group%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dgroup-modify%0A-a%20always%2Cexit%20-F%20path%3D/etc/gshadow%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dgroup-modify%0A%0A%0A%23%23%20Use%20of%20special%20rights%20for%20config%20changes.%20This%20would%20be%20use%20of%20setuid%0A%23%23%20programs%20that%20relate%20to%20user%20accts.%20This%20is%20not%20all%20setuid%20apps%20because%0A%23%23%20requirements%20are%20only%20for%20ones%20that%20affect%20system%20configuration.%0A-a%20always%2Cexit%20-F%20path%3D/usr/sbin/unix_chkpwd%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/sbin/usernetctl%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/sbin/userhelper%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/sbin/seunshare%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/mount%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/newgrp%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/newuidmap%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/gpasswd%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/newgidmap%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/umount%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/passwd%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/crontab%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A-a%20always%2Cexit%20-F%20path%3D/usr/bin/at%20-F%20perm%3Dx%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dspecial-config-changes%0A%0A%23%23%20Privilege%20escalation%20via%20su%20or%20sudo.%20This%20is%20entirely%20handled%20by%20pam.%0A%0A%23%23%20Audit%20log%20access%0A-a%20always%2Cexit%20-F%20dir%3D/var/log/audit/%20-F%20perm%3Dr%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Daccess-audit-trail%0A%23%23%20Attempts%20to%20Alter%20Process%20and%20Session%20Initiation%20Information%0A-a%20always%2Cexit%20-F%20path%3D/var/run/utmp%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsession%0A-a%20always%2Cexit%20-F%20path%3D/var/log/btmp%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsession%0A-a%20always%2Cexit%20-F%20path%3D/var/log/wtmp%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3Dsession%0A%0A%23%23%20Attempts%20to%20modify%20MAC%20controls%0A-a%20always%2Cexit%20-F%20dir%3D/etc/selinux/%20-F%20perm%3Dwa%20-F%20auid%3E%3D1000%20-F%20auid%21%3Dunset%20-F%20key%3DMAC-policy%0A%0A%23%23%20Software%20updates.%20This%20is%20entirely%20handled%20by%20rpm.%0A%0A%23%23%20System%20start%20and%20shutdown.%20This%20is%20entirely%20handled%20by%20systemd%0A%0A%23%23%20Kernel%20Module%20loading.%20This%20is%20handled%20in%2043-module-load.rules%0A%0A%23%23%20Application%20invocation.%20The%20requirements%20list%20an%20optional%20requirement%0A%23%23%20FPT_SRP_EXT.1%20Software%20Restriction%20Policies.%20This%20event%20is%20intended%20to%0A%23%23%20state%20results%20from%20that%20policy.%20This%20would%20be%20handled%20entirely%20by%0A%23%23%20that%20daemon.%0A - mode: 0600 - path: /etc/audit/rules.d/30-ospp-v42.rules - overwrite: true - - - - - - - - - - Configure auditing of unsuccessful ownership changes - Ensure that unsuccessful attempts to change an ownership of files or directories are audited. - -The following rules configure audit as described above: -## Unsuccessful ownership change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000466-GPOS-00210 - SRG-OS-000064-GPOS-00033 - Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities. - - - - - - - - - - Configure auditing of successful ownership changes - Ensure that successful attempts to change an ownership of files or directories are audited. - -The following rules configure audit as described above: -## Successful ownership change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000466-GPOS-00210 - SRG-OS-000064-GPOS-00033 - Auditing of successful ownership changes of files or directories helps in monitoring or investingating of activities performed on the system. - - - - - - - - - - Configure auditing of unsuccessful permission changes - Ensure that unsuccessful attempts to change file or directory permissions are audited. - -The following rules configure audit as described above: -## Unsuccessful permission change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000466-GPOS-00210 - SRG-OS-000064-GPOS-00033 - Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities. - - - - - - - - - - Configure auditing of successful permission changes - Ensure that successful attempts to modify permissions of files or directories are audited. - -The following rules configure audit as described above: -## Successful permission change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change - -Load new Audit rules into kernel by running: -augenrules --load - -Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. - AU-2(a) - FAU_GEN.1.1.c - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000466-GPOS-00210 - SRG-OS-000064-GPOS-00033 - Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system. - - - - - - - - - - Configure audit according to OSPP requirements - Configure audit to meet requirements for Operating System Protection Profile (OSPP) v4.2.1. - -Audit defines groups of rules in /usr/share/doc/audit/rules to satisfy specific policies. - -To fulfill requirements for compliance with OSPP v4.2.1, the following files are necessary: -/usr/share/doc/audit/rules/10-base-config.rules/usr/share/doc/audit/rules/11-loginuid.rules/usr/share/doc/audit/rules/30-ospp-v42.rules/usr/share/doc/audit/rules/43-module-load.rules - -Copy the files from /usr/share/doc/audit/rules to /etc/audit/rules.d: - -cp /usr/share/doc/audit*/rules/{10-base-config,11-loginuid,30-ospp-v42,43-module-load}.rules /etc/audit/rules.d/ - - It might happen that Audit buffer configured by this rule is not large enough for certain use cases. If that is the case, the buffer size can be overridden by placing -b larger_buffer_size into a file within /etc/audit/rules.d directory, replacing larger_file_size with the desired value. The file name should start with a number higher than 10 and lower than 99. - NONE - FAU_GEN.1.1.c - SRG-OS-000004-GPOS-00004 - SRG-OS-000240-GPOS-00090 - SRG-OS-000241-GPOS-00091 - SRG-OS-000303-GPOS-00120 - SRG-OS-000476-GPOS-00221 - SRG-OS-000327-GPOS-00127 - SRG-OS-000064-GPOS-00033 - SRG-OS-000365-GPOS-00152 - SRG-OS-000458-GPOS-00203 - SRG-OS-000461-GPOS-00205 - SRG-OS-000462-GPOS-00206 - SRG-OS-000463-GPOS-00207 - SRG-OS-000465-GPOS-00209 - SRG-OS-000466-GPOS-00210 - SRG-OS-000468-GPOS-00212 - SRG-OS-000470-GPOS-00214 - SRG-OS-000471-GPOS-00215 - SRG-OS-000471-GPOS-00216 - SRG-OS-000472-GPOS-00217 - SRG-OS-000474-GPOS-00219 - SRG-OS-000475-GPOS-00220 - SRG-OS-000477-GPOS-00222 - The audit rules defined in /usr/share/doc/audit/rules are the recommended way to meet compliance with OSPP v4.2.1. - - - - - - - - - - - - AppArmor - Many security vulnerabilities result from bugs in trusted programs. A trusted -program runs with privileges that attackers want to possess. The program fails -to keep that trust if there is a bug in the program that allows the attacker to -acquire said privilege. - -AppArmor® is an application security solution designed specifically to apply -privilege confinement to suspect programs. AppArmor allows the administrator to -specify the domain of activities the program can perform by developing a -security profile. A security profile is a listing of files that the program may -access and the operations the program may perform. AppArmor secures -applications by enforcing good application behavior without relying on attack -signatures, so it can prevent attacks even if previously unknown -vulnerabilities are being exploited. - - - GRUB2 bootloader configuration - During the boot process, the boot loader is -responsible for starting the execution of the kernel and passing -options to it. The boot loader allows for the selection of -different kernels - possibly on different partitions or media. -The default Red Hat Enterprise Linux CoreOS 4 boot loader for x86 systems is called GRUB2. -Options it can pass to the kernel include single-user mode, which -provides root access without any authentication, and the ability to -disable SELinux. To prevent local users from modifying the boot -parameters and endangering security, protect the boot loader configuration -with a password and ensure its configuration file's permissions -are set properly. - - - L1TF vulnerability mitigation - Defines the L1TF vulneratility mitigations to employ. - flush - full - full,force - flush - flush,nosmt - flush,nowarn - - - MDS vulnerability mitigation - Defines the MDS vulneratility mitigation to employ. - full - full - full,nosmt - - - Confidence level on Hardware Random Number Generator - Defines the level of trust on the hardware random number generators available in the -system and the percentage of entropy to credit. - 500 - 500 - 512 - 1000 - - - Spec Store Bypass Mitigation - This controls how the Speculative Store Bypass (SSB) vulnerability is mitigated. - prctl - on - auto - prctl - seccomp - - - Enable Kernel Page-Table Isolation (KPTI) - To enable Kernel page-table isolation, add the argument pti=on to all -BLS (Boot Loader Specification) entries ('options' line) for the Linux -operating system in /boot/loader/entries/*.conf. - SI-16 - SRG-OS-000433-GPOS-00193 - Kernel page-table isolation is a kernel feature that mitigates -the Meltdown security vulnerability and hardens the kernel -against attempts to bypass kernel address space layout -randomization (KASLR). - - CCE-82497-9 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - kernelArguments: - - pti=on - - - - - - - - - - Disable vsyscalls - To disable use of virtual syscalls, add the argument vsyscall=none to all -BLS (Boot Loader Specification) entries ('options' line) for the Linux -operating system in /boot/loader/entries/*.conf. - CM-7(a) - SRG-OS-000480-GPOS-00227 - Virtual Syscalls provide an opportunity of attack for a user who has control -of the return instruction pointer. - - CCE-82674-3 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - kernelArguments: - - vsyscall=none - - - - - - - - - - Disable Recovery Booting - Red Hat Enterprise Linux CoreOS 4 systems support an "recovery boot" option that can be used -to prevent services from being started. The GRUB_DISABLE_RECOVERY -configuration option in /etc/default/grub should be set to -true to disable the generation of recovery mode menu entries. It is -also required to change the runtime configuration, run: -$ sudo grubby --update-kernel=ALL - FIA_UAU.1 - Using recovery boot, the console user could disable auditing, firewalls, -or other services, weakening system security. - - - - - - - - - - IOMMU configuration directive - On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some - of the system critical units such as the memory. -Configure the default Grub2 kernel command line to contain iommu=force as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) iommu=force" - Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities. Proper function and stability should be assessed before applying remediation to production systems. - BP28(R11) - On x86 architectures, activating the I/OMMU prevents the system from arbitrary accesses potentially made by - hardware devices. - - - - - - - - - - Configure L1 Terminal Fault mitigations - L1 Terminal Fault (L1TF) is a hardware vulnerability which allows unprivileged -speculative access to data which is available in the Level 1 Data Cache when -the page table entry isn't present. - -Select the appropriate mitigation by adding the argument -l1tf= to the default -GRUB 2 command line for the Linux operating system. -Configure the default Grub2 kernel command line to contain l1tf= as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) l1tf=" - -Since Linux Kernel 4.19 you can check the L1TF vulnerability state with the -following command: -cat /sys/devices/system/cpu/vulnerabilities/l1tf - Enabling L1TF mitigations may impact performance of the system. - The L1TF vulnerability allows an attacker to bypass memory access security controls imposed -by the system or hypervisor. The L1TF vulnerability allows read access to any physical memory -location that is cached in the L1 Data Cache. - - - - - - - - - - - Force kernel panic on uncorrected MCEs - A Machine Check Exception is an error generated by the CPU itdetects an error -in itself, memory or I/O devices. -These errors may be corrected and generate a check log entry, if an error -cannot be corrected the kernel may panic or SIGBUS. - -To force the kernel to panic on any uncorrected error reported by Machine Check -set the MCE tolerance to zero by adding mce=0 -to the default GRUB 2 command line for the Linux operating system. -Configure the default Grub2 kernel command line to contain mce=0 as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) mce=0" - Allowing uncorrected errors to result on a SIGBUS may allow an attacker to continue -trying to exploit a vulnerability such as Rowhammer. - - - - - - - - - - Ensure SMAP is not disabled during boot - The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into -memory pages in the user space, it is enabled by default since Linux kernel 3.7. -But it could be disabled through kernel boot parameters. - -Ensure that Supervisor Mode Access Prevention (SMAP) is not disabled by -the nosmap boot paramenter option. - -Check that the line GRUB_CMDLINE_LINUX="..." within /etc/default/grub -doesn't contain the argument nosmap. -Run the following command to update command line for already installed kernels: -# grubby --update-kernel=ALL --remove-args="nosmap" - Disabling SMAP can facilitate exploitation of vulnerabilities caused by unintended access and -manipulation of data in the user space. - - - - - - - - - - Ensure SMEP is not disabled during boot - The SMEP is used to prevent the supervisor mode from executing user space code, -it is enabled by default since Linux kernel 3.0. But it could be disabled through -kernel boot parameters. - -Ensure that Supervisor Mode Execution Prevention (SMEP) is not disabled by -the nosmep boot paramenter option. - -Check that the line GRUB_CMDLINE_LINUX="..." within /etc/default/grub -doesn't contain the argument nosmep. -Run the following command to update command line for already installed kernels: -# grubby --update-kernel=ALL --remove-args="nosmep" - Disabling SMEP can facilitate exploitation of certain vulnerabilities because it allows -the kernel to unintentionally execute code in less privileged memory space. - - - - - - - - - - Configure the confidence in TPM for entropy - The TPM security chip that is available in most modern systems has a hardware RNG. -It is also used to feed the entropy pool, but generally not credited entropy. - -Use rng_core.default_quality in the kernel command line to set the trust -level on the hardware generators. The trust level defines the amount of entropy to credit. -A value of 0 tells the system not to trust the hardware random number generators -available, and doesn't credit any entropy to the pool. -A value of 1000 assigns full confidence in the generators, and credits all the -entropy it provides to the pool. - -Note that the value of rng_core.default_quality is global, affecting the trust -on all hardware random number generators. - -Select the appropriate confidence by adding the argument -rng_core.default_quality= to the default -GRUB 2 command line for the Linux operating system. -Configure the default Grub2 kernel command line to contain rng_core.default_quality= as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) rng_core.default_quality=" - A system may struggle to initialize its entropy pool and end up starving. Crediting entropy -from the hardware number generators available in the system helps fill up the entropy pool. - - - - - - - - - - - Disable merging of slabs with similar size - The kernel may merge similar slabs together to reduce overhead and increase -cache hotness of objects. -Disabling merging of slabs keeps the slabs separate and reduces the risk of -kernel heap overflows overwriting objects in merged caches. - -To disable merging of slabs in the Kernel add the argument slab_nomerge=yes -to the default GRUB 2 command line for the Linux operating system. -Configure the default Grub2 kernel command line to contain slab_nomerge=yes as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) slab_nomerge=yes" - Disabling merge of slabs will slightly increase kernel memory utilization. - Disabling the merge of slabs of similar sizes prevents the kernel from -merging a seemingly useless but vulnerable slab with a useful and valuable slab. -This increase the risk that a heap overflow could overwrite objects from merged caches, -with unmerged caches the heap overflow would only affect the objects in the same cache. -Overall, this reduces the kernel attack surface area by isolating slabs from each other. - - - - - - - - - - Configure Speculative Store Bypass Mitigation - Certain CPUs are vulnerable to an exploit against a common wide industry wide performance -optimization known as Speculative Store Bypass (SSB). - -In such cases, recent stores to the same memory location cannot always be observed by later -loads during speculative execution. However, such stores are unlikely and thus they can be -detected prior to instruction retirement at the end of a particular speculation execution -window. - -Since Linux Kernel 4.17 you can check the SSB mitigation state with the following command: -cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass - -Select the appropriate SSB state by adding the argument -spec_store_bypass_disable= to the default -GRUB 2 command line for the Linux operating system. -Configure the default Grub2 kernel command line to contain spec_store_bypass_disable= as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) spec_store_bypass_disable=" - Disabling Speculative Store Bypass may impact performance of the system. - In vulnerable processsors, the speculatively forwarded store can be used in a cache side channel -attack. An example of this is reading memory to which the attacker does not directly have access, -for example inside the sandboxed code. - - - - - - - - - - - Enforce Spectre v2 mitigation - Spectre V2 is an indirect branch poisoning attack that can lead to data leakage. -An exploit for Spectre V2 tricks the indirect branch predictor into executing -code from a future indirect branch chosen by the attacker, even if the privilege -level is different. - -Since Linux Kernel 4.15 you can check the Spectre V2 mitigation state with the following command: -cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 - -Enforce the Spectre V2 mitigation by adding the argument -spectre_v2=on to the default -GRUB 2 command line for the Linux operating system. -Configure the default Grub2 kernel command line to contain spectre_v2=on) as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) spectre_v2=on)" - The Spectre V2 vulnerability allows an attacker to read memory that he should not have -access to. - - - - - - - - - - Ensure debug-shell service is not enabled during boot - systemd's debug-shell service is intended to -diagnose systemd related boot issues with various systemctl -commands. Once enabled and following a system reboot, the root shell -will be available on tty9 which is access by pressing -CTRL-ALT-F9. The debug-shell service should only be used -for systemd related issues and should otherwise be disabled. - -By default, the debug-shell systemd service is already disabled. - -Ensure the debug-shell is not enabled by the systemd.debug-shel=1 -boot paramenter option. - -Check that the line GRUB_CMDLINE_LINUX="..." within /etc/default/grub -doesn't contain the argument systemd.debug-shell=1. -Run the following command to update command line for already installed kernels: -# grubby --update-kernel=ALL --remove-args="systemd.debug-shell" - FIA_UAU.1 - This prevents attackers with physical access from trivially bypassing security -on the machine through valid troubleshooting configurations and gaining root -access when the system is rebooted. - - - - - - - - - - Non-UEFI GRUB2 bootloader configuration - Non-UEFI GRUB2 bootloader configuration - - - - UEFI GRUB2 bootloader configuration - UEFI GRUB2 bootloader configuration - - - Set the UEFI Boot Loader Admin Username to a Non-Default Value - The grub2 boot loader should have a superuser account and password -protection enabled to protect boot-time settings. - -To maximize the protection, select a password-protected superuser account with unique name, and modify the -/etc/grub.d/01_users configuration file to reflect the account name change. - -It is highly suggested not to use common administrator account names like root, -admin, or administrator for the grub2 superuser account. - -Change the superuser to a different username (The default is 'root'). -$ sed -i 's/\(set superusers=\).*/\1"<unique user ID>"/g' /etc/grub.d/01_users - -Once the superuser account has been added, -update the -grub.cfg file by running: -grubby --update-kernel=ALL - To prevent hard-coded admin usernames, automatic remediation of this control is not available. Remediation -must be automated as a component of machine provisioning, or followed manually as outlined above. - -Also, do NOT manually add the superuser account and password to the -grub.cfg file as the grub2-mkconfig command overwrites this file. - BP28(R17) - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - DSS06.06 - 3.4.5 - CCI-000213 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000080-GPOS-00048 - Having a non-default grub superuser username makes password-guessing attacks less effective. - - CCE-83540-5 - - - - - - - - - Set the UEFI Boot Loader Password - The grub2 boot loader should have a superuser account and password -protection enabled to protect boot-time settings. - -Since plaintext passwords are a security risk, generate a hash for the password -by running the following command: - -# grub2-setpassword - -When prompted, enter the password that was selected. - - To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation -must be automated as a component of machine provisioning, or followed manually as outlined above. - -Also, do NOT manually add the superuser account and password to the -grub.cfg file as the grub2-mkconfig command overwrites this file. - BP28(R17) - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - DSS06.06 - 3.4.5 - CCI-000213 - 164.308(a)(1)(ii)(B) - 164.308(a)(7)(i) - 164.308(a)(7)(ii)(A) - 164.310(a)(1) - 164.310(a)(2)(i) - 164.310(a)(2)(ii) - 164.310(a)(2)(iii) - 164.310(b) - 164.310(c) - 164.310(d)(1) - 164.310(d)(2)(iii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000080-GPOS-00048 - Password protection on the boot loader configuration ensures -users with physical access cannot trivially alter -important bootloader settings. These include which kernel to use, -and whether to enter single-user mode. - - CCE-82552-1 - - - - - - - - - - - zIPL bootloader configuration - During the boot process, the bootloader is -responsible for starting the execution of the kernel and passing -options to it. -The default Red Hat Enterprise Linux CoreOS 4 boot loader for s390x systems is called zIPL. - - - Enable Auditing to Start Prior to the Audit Daemon in zIPL - To ensure all processes can be audited, even those which start prior to the audit daemon, -check that all boot entries in /boot/loader/entries/*.conf have audit=1 -included in its options. - -To ensure that new kernels and boot entries continue to enable audit, -add audit=1 to /etc/kernel/cmdline. - FAU_GEN.1 - Each process on the system carries an "auditable" flag which indicates whether -its activities can be audited. Although auditd takes care of enabling -this for all processes which launch after it does, adding the kernel argument -ensures it is set for every process during boot. - - - - - - - - - - Extend Audit Backlog Limit for the Audit Daemon in zIPL - To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon, -check that all boot entries in /boot/loader/entries/*.conf have audit_backlog_limit=8192 -included in its options. -To ensure that new kernels and boot entries continue to extend the audit log events queue, -add audit_backlog_limit=8192 to /etc/kernel/cmdline. - FAU_STG.1 - FAU_STG.3 - audit_backlog_limit sets the queue length for audit events awaiting transfer -to the audit daemon. Until the audit daemon is up and running, all log messages -are stored in this queue. If the queue is overrun during boot process, the action -defined by audit failure flag is taken. - - - - - - - - - - Ensure all zIPL boot entries are BLS compliant - Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS) -by checking that /etc/zipl.conf doesn't contain image = . - To prevent breakage or removal of all boot entries oconfigured in /etc/zipl.conf -automated remediation for this rule is not available. - Red Hat Enterprise Linux CoreOS 4 adheres to Boot Loader Specification (BLS) and is the prefered method of -configuration. - - - - - - - - - - Ensure zIPL bootmap is up to date - Make sure that /boot/bootmap is up to date. -Every time a boot entry or zIPL configuration is changed /boot/bootmap needs to -be updated to reflect the changes. -Run zipl command to generate an updated /boot/bootmap. - The file /boot/bootmap contains all boot data, keeping it up to date is crucial to -boot correct kernel and options. - - - - - - - - - - Ensure SELinux Not Disabled in zIPL - To ensure SELinux is not disabled at boot time, -check that no boot entry in /boot/loader/entries/*.conf has selinux=0 -included in its options. - Disabling a major host protection feature, such as SELinux, at boot time prevents -it from confining system services at boot time. Further, it increases -the chances that it will remain off during system operation. - - - - - - - Enable page allocator poisoning in zIPL - To enable poisoning of free pages, -check that all boot entries in /boot/loader/entries/*.conf have page_poison=1 -included in its options. -To ensure that new kernels and boot entries continue to enable page poisoning, -add page_poison=1 to /etc/kernel/cmdline. - Poisoning writes an arbitrary value to freed pages, so any modification or -reference to that page after being freed or before being initialized will be -detected and prevented. -This prevents many types of use-after-free vulnerabilities at little performance cost. -Also prevents leak of data and detection of corrupted memory. - - - - - - - - - - Enable SLUB/SLAB allocator poisoning in zIPL - To enable poisoning of SLUB/SLAB objects, -check that all boot entries in /boot/loader/entries/*.conf have slub_debug=P -included in its options. -To ensure that new kernels and boot entries continue to enable poisoning of SLUB/SLAB objects, -add slub_debug=P to /etc/kernel/cmdline. - Poisoning writes an arbitrary value to freed objects, so any modification or -reference to that object after being freed or before being initialized will be -detected and prevented. -This prevents many types of use-after-free vulnerabilities at little performance cost. -Also prevents leak of data and detection of corrupted memory. - - - - - - - - - - Ensure debug-shell service is not enabled in zIPL - systemd's debug-shell service is intended to -diagnose systemd related boot issues with various systemctl -commands. Once enabled and following a system reboot, the root shell -will be available on tty9 which is access by pressing -CTRL-ALT-F9. The debug-shell service should only be used -for systemd related issues and should otherwise be disabled. - -By default, the debug-shell systemd service is already disabled. - -Ensure the debug-shell is not enabled by the systemd.debug-shel=1 -boot paramenter option. - -Check that not boot entries in /boot/loader/entries/*.conf have -systemd.debug-shell=1 included in its options. -To ensure that new kernels and boot entries don't enable the debug-shell, check -that systemd.debug-shell=1 is not present in /etc/kernel/cmdline. - FIA_UAU.1 - This prevents attackers with physical access from trivially bypassing security -on the machine through valid troubleshooting configurations and gaining root -access when the system is rebooted. - - - - - - - - - - Disable vsyscalls in zIPL - To disable use of virtual syscalls, -check that all boot entries in /boot/loader/entries/*.conf have vsyscall=none -included in its options. -To ensure that new kernels and boot entries continue to disable virtual syscalls, -add vsyscall=none to /etc/kernel/cmdline. - FPT_ASLR_EXT.1 - Virtual Syscalls provide an opportunity of attack for a user who has control -of the return instruction pointer. - - - - - - - - - - - Protect Random-Number Entropy Pool - The I/O operations of the Linux kernel block layer due to their inherently -unpredictable execution times have been traditionally considered as a reliable -source to contribute to random-number entropy pool of the Linux kernel. This -has changed with introduction of solid-state storage devices (SSDs) though. - - - Ensure Solid State Drives Do Not Contribute To Random-Number Entropy Pool - For each solid-state drive on the system, run: - # echo 0 > /sys/block/DRIVE/queue/add_random - In contrast to traditional electromechanical magnetic disks, containing -spinning disks and / or movable read / write heads, the solid-state storage -devices (SSDs) do not contain moving / mechanical components. Therefore the -I/O operation completion times are much more predictable for them. - - - - - Kernel Configuration - Contains rules that check the kernel configuration that was used to build it. - - - Hash function for kernel module signing - The hash function to use when signing modules during kernel build process. - sha512 - sha1 - sha224 - sha256 - sha384 - sha512 - - - Key and certificate for kernel module signing - The private key and certificate to use when signing modules during kernel build process. -On systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI as defined by RFC7512 -In the latter case, the PKCS#11 URI should reference both a certificate and a private key. - certs/signing_key.pem - certs/signing_key.pem - - - Kernel panic timeout - The time, in seconds, to wait until a reboot occurs. -If the value is 0 the system never reboots. -If the value is less than 0 the system reboots immediately. - 0 - 0 - 300 - 60 - -1 - - - Do not allow ACPI methods to be inserted/replaced at run time - This debug facility allows ACPI AML methods to be inserted and/or replaced without rebooting -the system. -This configuration is available from kernel 3.0. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_ACPI_CUSTOM_METHOD, run the following command: - grep CONFIG_ACPI_CUSTOM_METHOD /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Enabling this feature allows arbitrary kernel memory to be written to by root (uid=0) users, -allowing them to bypass certain security measures - - - - - - - - - - Disable kernel support for MISC binaries - Enabling CONFIG_BINFMT_MISC makes it possible to plug wrapper-driven binary formats -into the kernel. This is specially useful for programs that need an interpreter to run like -Java, Python and DOS emulators. Once you have registered such a binary class with the kernel, -you can start one of those programs simply by typing in its name at a shell prompt. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_BINFMT_MISC, run the following command: - grep CONFIG_BINFMT_MISC /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This disables arbitrary binary format support and helps reduce attack surface. - - - - - - - - - - Enable support for BUG() - Disabling this option eliminates support for BUG and WARN, reducing the size of your kernel -image and potentially quietly ignoring numerous fatal conditions. You should only consider -disabling this option for embedded systems with no facilities for reporting errors. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_BUG, run the following command: - grep CONFIG_BUG /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Not setting this variable may hide a number of critical errors. - - - - - - - - - - Disable compatibility with brk() - Enabling compatiliby with brk() allows legacy binaries to run (i.e. those linked -against libc5). But this compatibility comes at the cost of not being able to randomize -the heap placement (ASLR). - -Unless legacy binaries need to run on the system, set CONFIG_COMPAT_BRK to "n". - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_COMPAT_BRK, run the following command: - grep CONFIG_COMPAT_BRK /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Enabling compatibility with brk() disables support for ASLR. - - - - - - - - - - Disable the 32-bit vDSO - Certain buggy versions of glibc (2.3.3) will crash if they are presented with a 32-bit vDSO -that is not mapped at the address indicated in its segment table. -Setting CONFIG_COMPAT_VDSO to y turns off the 32-bit VDSO and works -aroud the glibc bug. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_COMPAT_VDSO, run the following command: - grep CONFIG_COMPAT_VDSO /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Enabling VDSO compatibility hurts performance and disables ASLR. - - - - - - - - - - Enable checks on credential management - Enable this to turn on some debug checking for credential management. The additional code keeps -track of the number of pointers from task_structs to any given cred struct, and checks to see -that this number never exceeds the usage count of the cred struct. - -Furthermore, if SELinux is enabled, this also checks that the security pointer in the cred -struct is never seen to be invalid. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_DEBUG_CREDENTIALS, run the following command: - grep CONFIG_DEBUG_CREDENTIALS /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This adds sanity checks and validations to credential data structures. - - - - - - - - - - Disable kernel debugfs - debugfs is a virtual file system that kernel developers use to put debugging files -into. Enable this option to be able to read and write to these files. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_DEBUG_FS, run the following command: - grep CONFIG_DEBUG_FS /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - To reduce the attack surface, this file system should be disabled if not in use. - - - - - - - - - - Enable checks on linked list manipulation - Enable this to turn on extended checks in the linked-list walking routines. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_DEBUG_LIST, run the following command: - grep CONFIG_DEBUG_LIST /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This add sanity checks to manipulation of linked lists structures in the kernel and may -prevent exploits such as CVE-2017-1661, where a race condition and simultaneos operations -caused a list to corrupt. - - - - - - - - - - Enable checks on notifier call chains - Enable this to turn on sanity checking for notifier call chains. This is most useful for kernel -developers to make sure that modules properly unregister themselves from notifier chains. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_DEBUG_NOTIFIERS, run the following command: - grep CONFIG_DEBUG_NOTIFIERS /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This provides validation of notifier chains, it checks whether the notifiers are from the -kernel or a module that is still loaded prior to being invoked. - - - - - - - - - - Enable checks on scatter-gather (SG) table operations - Scatter-gather tables are mechanism used for high performance I/O on DMA devices. -Enable this to turn on checks on scatter-gather tables. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_DEBUG_SG, run the following command: - grep CONFIG_DEBUG_SG /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This can help find problems with drivers that do not properly initialize their SG tables. - - - - - - - - - - Configure low address space to protect from user allocation - This is the portion of low virtual memory which should be protected from userspace allocation. -This configuration is available from kernel 3.14, but may be available if backported -by distros. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_DEFAULT_MMAP_MIN_ADDR, run the following command: - grep CONFIG_DEFAULT_MMAP_MIN_ADDR /boot/config-* - - For each kernel installed, a line with value "65536" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Keeping a user from writing to low pages can help reduce the impact of kernel NULL pointer bugs. - - - - - - - - - - Disable /dev/kmem virtual device support - Disable support for the /dev/kmem device. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_DEVKMEM, run the following command: - grep CONFIG_DEVKMEM /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - The /dev/kmem device is rarely used, but can be used for certain kind of kernel debugging -operations. - - - - - - - - - - Disable hibernation - Enable the suspend to disk (STD) functionality, which is usually called "hibernation" in user -interfaces. STD checkpoints the system and powers it off; and restores that checkpoint on -reboot. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_HIBERNATION, run the following command: - grep CONFIG_HIBERNATION /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Suspending to disk allows one to replace the running kernel. - - - - - - - - - - Disable IA32 emulation - Disables support for legacy 32-bit programs under a 64-bit kernel. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_IA32_EMULATION, run the following command: - grep CONFIG_IA32_EMULATION /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Only disable support for 32-bit programs if you are sure you don't need any 32-bit program. - Disabling 32-bit backwards compatibility helps reduce the attack surface. - - - - - - - - - - Disable the IPv6 protocol - Disable support for IP version 6 (IPv6). - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_IPV6, run the following command: - grep CONFIG_IPV6 /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Any unnecessary network stacks, including IPv6, should be disabled to reduce -the vulnerability to exploitation. - - - - - - - - - - Disable kexec system call - kexec is a system call that implements the ability to shutdown your current kernel, -and to start another kernel. It is like a reboot but it is independent of the system firmware. -And like a reboot you can start any kernel with it, not just Linux. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_KEXEC, run the following command: - grep CONFIG_KEXEC /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Prohibits the execution of a new kernel image after reboot. - - - - - - - - - - Disable legacy (BSD) PTY support - Disable the Linux traditional BSD-like terminal names /dev/ptyxx for masters and /dev/ttyxx for -slaves of pseudo terminals, and use only the modern ptys (devpts) interface. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_LEGACY_PTYS, run the following command: - grep CONFIG_LEGACY_PTYS /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - The legacy scheme has a number of security problems. - - - - - - - - - - Enable module signature verification - Check modules for valid signatures upon load. -Note that this option adds the OpenSSL development packages as a kernel build dependency so -that the signing tool can use its crypto library. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_MODULE_SIG, run the following command: - grep CONFIG_MODULE_SIG /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Loaded modules must be signed. - - - - - - - - - - Enable automatic signing of all modules - Sign all modules during make modules_install. Without this option, modules must be signed -manually, using the scripts/sign-file tool. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_MODULE_SIG_ALL, run the following command: - grep CONFIG_MODULE_SIG_ALL /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This ensures the modules are signed during install process. - - - - - - - - - - Require modules to be validly signed - Reject unsigned modules or signed modules with an unknown key. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_MODULE_SIG_FORCE, run the following command: - grep CONFIG_MODULE_SIG_FORCE /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Prevent loading modules that are unsigned or signed with an unknown key. - - - - - - - - - - Specify the hash to use when signing modules - This configures the kernel to build and sign modules using - as the hash function. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_MODULE_SIG_HASH, run the following command: - grep CONFIG_MODULE_SIG_HASH /boot/config-* - - For each kernel installed, a line with value "" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Use of strong hash function is important to secure the module against counterfeit signatures. - - - - - - - - - - - Specify module signing key to use - Setting this option to something other than its default of certs/signing_key.pem will -disable the autogeneration of signing keys and allow the kernel modules to be signed with a key -of your choosing. - -The string provided should identify a file containing both a private key and -its corresponding X.509 certificate in PEM form, or — on systems where the OpenSSL ENGINE_pkcs11 -is functional — a PKCS#11 URI as defined by RFC7512. In the latter case, the PKCS#11 URI should -reference both a certificate and a private key. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_MODULE_SIG_KEY, run the following command: - grep CONFIG_MODULE_SIG_KEY /boot/config-* - - For each kernel installed, a line with value "" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - A key and certificate is required to sign the built modules. - - - - - - - - - - - Sign kernel modules with SHA-512 - This configures the kernel to build and sign modules using SHA512 as the hash function. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_MODULE_SIG_SHA512, run the following command: - grep CONFIG_MODULE_SIG_SHA512 /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Use of strong hash function is important to secure the module against counterfeit signatures. - - - - - - - - - - Enable poison without sanity check - Skip the sanity checking on alloc, only fill the pages with poison on free. This reduces some -of the overhead of the poisoning feature. -This configuration is available from kernel 4.6. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_PAGE_POISONING_NO_SANITY, run the following command: - grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This configuration helps alleviates the performance impact of poisonining. - - - - - - - - - - Use zero for poisoning instead of debugging value - Instead of using the existing poison value, fill the pages with zeros. This makes it harder to -detect when errors are occurring due to sanitization but the zeroing at free means that it is -no longer necessary to write zeros when GFP_ZERO is used on allocation. -This configuration is available from kernel 4.19. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_PAGE_POISONING_ZERO, run the following command: - grep CONFIG_PAGE_POISONING_ZERO /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This configuration helps alleviates the performance impact of poisonining. - - - - - - - - - - Remove the kernel mapping in user mode - This feature reduces the number of hardware side channels by ensuring that the majority of -kernel addresses are not mapped into userspace. -This configuration is available from kernel 4.15, but may be available if backported -by distros. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_PAGE_TABLE_ISOLATION, run the following command: - grep CONFIG_PAGE_TABLE_ISOLATION /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This is a countermeasure to the Meltdown attack. - - - - - - - - - - Kernel panic oops - Enable the kernel to panic when it oopses. -This has the same effect as setting oops=panic on the kernel command line. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_PANIC_ON_OOPS, run the following command: - grep CONFIG_PANIC_ON_OOPS /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This feature ensures that the kernel does not do anything erroneous after an oops which -could result in data corruption or other issues. - - - - - - - - - - Kernel panic timeout - Set the timeout value (in seconds) until a reboot occurs when the kernel panics. -A timeout of 0 configures the system to wait forever. With a timeout value greater than 0, -the system will wait the specified amount of seconds before rebooting. While a timeout value -less than 0 makes the system reboot immediately. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_PANIC_TIMEOUT, run the following command: - grep CONFIG_PANIC_TIMEOUT /boot/config-* - - For each kernel installed, a line with value "" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This is required to enable protection against Spectre v2. - - - - - - - - - - - Disable support for /proc/kkcore - Provides a virtual ELF core file of the live kernel. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_PROC_KCORE, run the following command: - grep CONFIG_PROC_KCORE /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This feature exposes the memory to the userspace and can assist an attacker in discovering -attack vectors. - - - - - - - - - - Randomize the address of the kernel image (KASLR) - In support of Kernel Address Space Layout Randomization (KASLR), this randomizes the physical -address at which the kernel image is decompressed and the virtual address where the kernel -image is mapped. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_RANDOMIZE_BASE, run the following command: - grep CONFIG_RANDOMIZE_BASE /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - An unpredictable kernel address makes it more difficult to succeed with exploits that rely on -knowledge of the location of kernel code internals. - - - - - - - - - - Randomize the kernel memory sections - Randomizes the base virtual address of kernel memory sections (physical memory mapping, -vmalloc & vmemmap). -This configuration is available from kernel 4.8, but may be available if backported -by distros. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_RANDOMIZE_MEMORY, run the following command: - grep CONFIG_RANDOMIZE_MEMORY /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This security feature makes exploits relying on predictable memory locations less reliable. - - - - - - - - - - Avoid speculative indirect branches in kernel - Compile kernel with the retpoline compiler options to guard against kernel-to-user data leaks -by avoiding speculative indirect branches. -Requires a compiler with -mindirect-branch=thunk-extern support for full protection. -The kernel may run slower. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_RETPOLINE, run the following command: - grep CONFIG_RETPOLINE /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This is required to enable protection against Spectre v2. - - - - - - - - - - Enable seccomp to safely compute untrusted bytecode - This kernel feature is useful for number crunching applications that may need to compute -untrusted bytecode during their execution. By using pipes or other transports made available -to the process as file descriptors supporting the read/write syscalls, it's possible to isolate -those applications in their own address space using seccomp. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SECCOMP, run the following command: - grep CONFIG_SECCOMP /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - seccomp enables the ability to filter system calls made by an application, effectively -isolating the system's resources from it. - - - - - - - - - - Enable use of Berkeley Packet Filter with seccomp - Enable tasks to build secure computing environments defined in terms of Berkeley Packet Filter -programs which implement task-defined system call filtering polices. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SECCOMP_FILTER, run the following command: - grep CONFIG_SECCOMP_FILTER /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Use of BPF filters allows for expressive filtering of system calls using a filter program -language with a long history of being exposed to userland. - - - - - - - - - - Enable different security models - This allows you to choose different security modules to be configured into your kernel. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SECURITY, run the following command: - grep CONFIG_SECURITY /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This is enables kernel security primitives required by the LSM framework. - - - - - - - - - - Restrict unprivileged access to the kernel syslog - Enforce restrictions on unprivileged users reading the kernel syslog via dmesg(8). - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SECURITY_DMESG_RESTRICT, run the following command: - grep CONFIG_SECURITY_DMESG_RESTRICT /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Prevents unprivileged users from retrieving kernel addresses with dmesg. - - - - - - - - - - Disable mutable hooks - Ensure kernel structures associated with LSMs are always mapped as read-only after system boot. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SECURITY_WRITABLE_HOOKS, run the following command: - grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - If CONFIG_SECURITY_WRITABLE_HOOKS is enabled, then hooks can be loaded at runtime and -being able to manipulate hooks is a way to bypass all LSMs. - - - - - - - - - - Enable Yama support - This enables support for LSM module Yama, which extends DAC support with additional system-wide -security settings beyond regular Linux discretionary access controls. The module will limit the -use of the system call ptrace(). - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SECURITY_YAMA, run the following command: - grep CONFIG_SECURITY_YAMA /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - Unrestricted usage of ptrace allows compromised binaries to run ptrace -on another processes of the user. - - - - - - - - - - Enable SLUB debugging support - SLUB has extensive debug support features and this allows the allocator validation checking to -be enabled. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SLUB_DEBUG, run the following command: - grep CONFIG_SLUB_DEBUG /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This activates the checking of the memory allocator structures and resets to zero the zones -allocated when they are released. - - - - - - - - - - Enable TCP/IP syncookie support - Normal TCP/IP networking is open to an attack known as SYN flooding. -It is denial-of-service attack that prevents legitimate remote users from being able to connect -to your computer during an ongoing attack. - -When enabled the TCP/IP stack will use a cryptographic challenge protocol known as SYN cookies -to enable legitimate users to continue to connect, even when your machine is under attack. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_SYN_COOKIES, run the following command: - grep CONFIG_SYN_COOKIES /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - SYN cookies provide protection against SYN flooding attacks. - - - - - - - - - - Unmap kernel when running in userspace (aka KAISER) - Speculation attacks against some high-performance processors can be used to bypass MMU -permission checks and leak kernel data to userspace. This can be defended against by unmapping -the kernel when running in userspace, mapping it back in on exception entry via a trampoline -page in the vector table. -This configuration is available from kernel 4.16, but may be available if backported -by distros. -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_UNMAP_KERNEL_AT_EL0, run the following command: - grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config-* - - For each kernel installed, a line with value "y" should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - This is a countermeasure to the Meltdown attack. - - - - - - - - - - Disable x86 vsyscall emulation - Disabling it is roughly equivalent to booting with vsyscall=none, except that it will also -disable the helpful warning if a program tries to use a vsyscall. With this option set to N, -offending programs will just segfault, citing addresses of the form 0xffffffffff600?00. -This configuration is available from kernel 3.19. - -The configuration that was used to build kernel is available at /boot/config-*. - To check the configuration value for CONFIG_X86_VSYSCALL_EMULATION, run the following command: - grep CONFIG_X86_VSYSCALL_EMULATION /boot/config-* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - There is no remediation for this besides re-compiling the kernel with the appropriate value for the config. - The vsyscall table is no longer required and is a potential source of ROP gadgets. - - - - - - - - - - Kernel GCC plugin configuration - Contains rules that check the configuration of GCC plugins used by the compiler - - - - - Configure Syslog - The syslog service has been the default Unix logging mechanism for -many years. It has a number of downsides, including inconsistent log format, -lack of authentication for received messages, and lack of authentication, -encryption, or reliable transport for messages sent over a network. However, -due to its long history, syslog is a de facto standard which is supported by -almost all Unix applications. - - -In Red Hat Enterprise Linux CoreOS 4, rsyslog has replaced ksyslogd as the -syslog daemon of choice, and it includes some additional security features -such as reliable, connection-oriented (i.e. TCP) transmission of logs, the -option to log to database formats, and the encryption of log data en route to -a central logging server. -This section discusses how to configure rsyslog for -best effect, and how to use tools provided with the system to maintain and -monitor logs. - - - Ensure rsyslog is Installed - Rsyslog is installed by default. The rsyslog package can be installed with the following command: - BP28(R5) - NT28(R46) - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-001311 - CCI-001312 - CCI-000366 - 164.312(a)(2)(ii) - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - PR.PT-1 - FTP_ITC_EXT.1.1 - SRG-OS-000479-GPOS-00224 - SRG-OS-000051-GPOS-00024 - SRG-OS-000480-GPOS-00227 - The rsyslog package provides the rsyslog daemon, which provides -system logging services. - - - - - - - - - - Enable rsyslog Service - The rsyslog service provides syslog-style logging by default on Red Hat Enterprise Linux CoreOS 4. - -The rsyslog service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-rsyslog-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: rsyslog.service - enabled: true - - -This will enable the rsyslog service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - BP28(R5) - NT28(R46) - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO13.01 - BAI03.05 - BAI04.04 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - CCI-001311 - CCI-001312 - CCI-001557 - CCI-001851 - CCI-000366 - 164.312(a)(2)(ii) - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.17.2.1 - CM-6(a) - AU-4(1) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.DS-4 - PR.PT-1 - SRG-OS-000480-GPOS-00227 - The rsyslog service must be running in order to provide -logging services, which are essential to system administration. - - - - - - - - - - Configure Logwatch on the Central Log Server - Is this system the central log server? If so, edit the file /etc/logwatch/conf/logwatch.conf as shown below. - - - - Ensure Proper Configuration of Log Files - The file /etc/rsyslog.conf controls where log message are written. -These are controlled by lines called rules, which consist of a -selector and an action. -These rules are often customized depending on the role of the system, the -requirements of the environment, and whatever may enable -the administrator to most effectively make use of log data. -The default rules in Red Hat Enterprise Linux CoreOS 4 are: -*.info;mail.none;authpriv.none;cron.none /var/log/messages -authpriv.* /var/log/secure -mail.* -/var/log/maillog -cron.* /var/log/cron -*.emerg * -uucp,news.crit /var/log/spooler -local7.* /var/log/boot.log -See the man page rsyslog.conf(5) for more information. -Note that the rsyslog daemon can be configured to use a timestamp format that -some log processing programs may not understand. If this occurs, -edit the file /etc/rsyslog.conf and add or edit the following line: -$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat - - - group who owns log files - Specify group owner of all logfiles specified in -/etc/rsyslog.conf. - root - adm - root - - - User who owns log files - Specify user owner of all logfiles specified in -/etc/rsyslog.conf. - root - adm - root - syslog - - - Ensure Rsyslog Authenticates Off-Loaded Audit Records - Rsyslogd is a system utility providing support for message logging. Support -for both internet and UNIX domain sockets enables this utility to support both local -and remote logging. Couple this utility with gnutls (which is a secure communications -library implementing the SSL, TLS and DTLS protocols), and you have a method to securely -encrypt and off-load auditing. - -When using rsyslogd to off-load logs the remote system must be authenticated. - CCI-001851 - AU-4(1) - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - The audit records generated by Rsyslog contain valuable information regarding system -configuration, user authentication, and other such information. Audit records should be -protected from unauthorized access. - - - - - - - - - - Ensure Rsyslog Encrypts Off-Loaded Audit Records - Rsyslogd is a system utility providing support for message logging. Support -for both internet and UNIX domain sockets enables this utility to support both local -and remote logging. Couple this utility with gnutls (which is a secure communications -library implementing the SSL, TLS and DTLS protocols), and you have a method to securely -encrypt and off-load auditing. - -When using rsyslogd to off-load logs off a encrpytion system must be used. - CCI-001851 - AU-4(1) - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - The audit records generated by Rsyslog contain valuable information regarding system -configuration, user authentication, and other such information. Audit records should be -protected from unauthorized access. - - - - - - - - - - Ensure Rsyslog Encrypts Off-Loaded Audit Records - Rsyslogd is a system utility providing support for message logging. Support -for both internet and UNIX domain sockets enables this utility to support both local -and remote logging. Couple this utility with gnutls (which is a secure communications -library implementing the SSL, TLS and DTLS protocols), and you have a method to securely -encrypt and off-load auditing. - -When using rsyslogd to off-load logs off an encryption system must be used. - CCI-001851 - AU-4(1) - SRG-OS-000342-GPOS-00133 - SRG-OS-000479-GPOS-00224 - The audit records generated by Rsyslog contain valuable information regarding system -configuration, user authentication, and other such information. Audit records should be -protected from unauthorized access. - - - - - - - - - - Ensure Log Files Are Owned By Appropriate Group - The group-owner of all log files written by -rsyslog should be . -These log files are determined by the second part of each Rule line in -/etc/rsyslog.conf and typically all appear in /var/log. -For each log file LOGFILE referenced in /etc/rsyslog.conf, -run the following command to inspect the file's group owner: -$ ls -l LOGFILE -If the owner is not , run the following command to -correct this: -$ sudo chgrp LOGFILE - BP28(R46) - BP28(R5) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-001314 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - 0988 - 1405 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-10.5.1 - Req-10.5.2 - The log files generated by rsyslog contain valuable information regarding system -configuration, user authentication, and other such information. Log files should be -protected from unauthorized access. - - - - - - - - - - Ensure Log Files Are Owned By Appropriate User - The owner of all log files written by -rsyslog should be . -These log files are determined by the second part of each Rule line in -/etc/rsyslog.conf and typically all appear in /var/log. -For each log file LOGFILE referenced in /etc/rsyslog.conf, -run the following command to inspect the file's owner: -$ ls -l LOGFILE -If the owner is not , run the following command to -correct this: -$ sudo chown LOGFILE - BP28(R46) - BP28(R5) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-001314 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - 0988 - 1405 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-10.5.1 - Req-10.5.2 - The log files generated by rsyslog contain valuable information regarding system -configuration, user authentication, and other such information. Log files should be -protected from unauthorized access. - - - - - - - - - - Ensure System Log Files Have Correct Permissions - The file permissions for all log files written by rsyslog should -be set to 600, or more restrictive. These log files are determined by the -second part of each Rule line in /etc/rsyslog.conf and typically -all appear in /var/log. For each log file LOGFILE -referenced in /etc/rsyslog.conf, run the following command to -inspect the file's permissions: -$ ls -l LOGFILE -If the permissions are not 600 or more restrictive, run the following -command to correct this: -$ sudo chmod 0600 LOGFILE" - BP28(R36) - CCI-001314 - 0988 - 1405 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - Req-10.5.1 - Req-10.5.2 - Log files can contain valuable information regarding system -configuration. If the system log files are not protected unauthorized -users could change the logged data, eliminating their forensic value. - - - - - - - - - - - systemd-journald - systemd-journald is a system service that collects and stores -logging data. It creates and maintains structured, indexed -journals based on logging information that is received from a -variety of sources. - -For more information on systemd-journald and additional systemd-journald configuration options, see -https://systemd.io/. - - - Enable systemd-journald Service - The systemd-journald service is an essential component of -systemd. - -The systemd-journald service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-systemd-journald-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: systemd-journald.service - enabled: true - - -This will enable the systemd-journald service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - CCI-001665 - SC-24 - SRG-OS-000269-GPOS-00103 - In the event of a system failure, Red Hat Enterprise Linux CoreOS 4 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes. - - - - - - - - - - - Ensure All Logs are Rotated by logrotate - -Edit the file /etc/logrotate.d/syslog. Find the first - -line, which should look like this (wrapped for clarity): -/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \ - /var/log/boot.log /var/log/cron { -Edit this line so that it contains a one-space-separated -listing of each log file referenced in /etc/rsyslog.conf. - -All logs in use on a system must be rotated regularly, or the -log files will consume disk space over time, eventually interfering -with system operation. The file /etc/logrotate.d/syslog is the -configuration file used by the logrotate program to maintain all -log files written by syslog. By default, it rotates logs weekly and -stores four archival copies of each log. These settings can be -modified by editing /etc/logrotate.conf, but the defaults are -sufficient for purposes of this guide. - -Note that logrotate is run nightly by the cron job -/etc/cron.daily/logrotate. If particularly active logs need to be -rotated more often than once a day, some other mechanism must be -used. - - - Ensure Logrotate Runs Periodically - The logrotate utility allows for the automatic rotation of -log files. The frequency of rotation is specified in /etc/logrotate.conf, -which triggers a cron task. To configure logrotate to run daily, add or correct -the following line in /etc/logrotate.conf: -# rotate log files frequency -daily - BP28(R43) - NT12(R18) - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000366 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - PR.PT-1 - Req-10.7 - Log files that are not properly rotated run the risk of growing so large -that they fill up the /var/log partition. Valuable logging information could be lost -if the /var/log partition becomes full. - - CCE-82689-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }} - mode: 0644 - path: /etc/logrotate.conf - overwrite: true - - - - - - - - - - - Configure rsyslogd to Accept Remote Messages If Acting as a Log Server - By default, rsyslog does not listen over the network -for log messages. If needed, modules can be enabled to allow -the rsyslog daemon to receive messages from other systems and for the system -thus to act as a log server. -If the system is not a log server, then lines concerning these modules -should remain commented out. - - - - Ensure syslog-ng is Installed - syslog-ng can be installed in replacement of rsyslog. -The syslog-ng-core package can be installed with the following command: - - BP28(R46) - BP28(R5) - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-001311 - CCI-001312 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - PR.PT-1 - The syslog-ng-core package provides the syslog-ng daemon, which provides -system logging services. - - - - - - - - - - Enable syslog-ng Service - The syslog-ng service (in replacement of rsyslog) provides syslog-style logging by default on Debian. - -The syslog-ng service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-syslog-ng-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: syslog-ng.service - enabled: true - - -This will enable the syslog-ng service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - BP28(R46) - BP28(R5) - 1 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - 7 - 8 - 9 - APO10.01 - APO10.03 - APO10.04 - APO10.05 - APO11.04 - APO13.01 - BAI03.05 - BAI04.04 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - MEA01.01 - MEA01.02 - MEA01.03 - MEA01.04 - MEA01.05 - MEA02.01 - CCI-001311 - CCI-001312 - CCI-001557 - CCI-001851 - 4.3.2.6.7 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 6.1 - SR 6.2 - SR 7.1 - SR 7.2 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.14.2.7 - A.15.2.1 - A.15.2.2 - A.17.2.1 - CM-6(a) - AU-4(1) - DE.CM-1 - DE.CM-3 - DE.CM-7 - ID.SC-4 - PR.DS-4 - PR.PT-1 - The syslog-ng service must be running in order to provide -logging services, which are essential to system administration. - - - - - - - - - - Enable rsyslog to Accept Messages via TCP, if Acting As Log Server - The rsyslog daemon should not accept remote messages -unless the system acts as a log server. -If the system needs to act as a central log server, add the following lines to -/etc/rsyslog.conf to enable reception of messages over TCP: -$ModLoad imtcp -$InputTCPServerRun 514 - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CIP-004-6 R2.2.2 - CIP-004-6 R3.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R6.5 - CM-6(a) - AU-6(3) - AU-6(4) - PR.PT-1 - If the system needs to act as a log server, this ensures that it can receive -messages over a reliable TCP connection. - - - - Enable rsyslog to Accept Messages via UDP, if Acting As Log Server - The rsyslog daemon should not accept remote messages -unless the system acts as a log server. -If the system needs to act as a central log server, add the following lines to -/etc/rsyslog.conf to enable reception of messages over UDP: -$ModLoad imudp -$UDPServerRun 514 - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CIP-004-6 R2.2.2 - CIP-004-6 R3.3 - CIP-007-3 R.1.3 - CIP-007-3 R5 - CIP-007-3 R5.1.1 - CIP-007-3 R6.5 - CM-6(a) - AU-6(3) - AU-6(4) - PR.PT-1 - Many devices, such as switches, routers, and other Unix-like systems, may only support -the traditional syslog transmission over UDP. If the system must act as a log server, -this enables it to receive their messages as well. - - - - - Rsyslog Logs Sent To Remote Host - If system logs are to be useful in detecting malicious -activities, it is necessary to send logs to a remote server. An -intruder who has compromised the root account on a system may -delete the log entries which indicate that the system was attacked -before they are seen by an administrator. - -However, it is recommended that logs be stored on the local -host in addition to being sent to the loghost, especially if -rsyslog has been configured to use the UDP protocol to send -messages over a network. UDP does not guarantee reliable delivery, -and moderately busy sites will lose log messages occasionally, -especially in periods of high traffic which may be the result of an -attack. In addition, remote rsyslog messages are not -authenticated in any way by default, so it is easy for an attacker to -introduce spurious messages to the central log server. Also, some -problems cause loss of network connectivity, which will prevent the -sending of messages to the central server. For all of these reasons, it is -better to store log messages both centrally and on each host, so -that they can be correlated if necessary. - - - Remote Log Server - Specify an URI or IP address of a remote host where the log messages will be sent and stored. - logcollector - - - Ensure Logs Sent To Remote Host - To configure rsyslog to send logs to a remote log server, -open /etc/rsyslog.conf and read and understand the last section of the file, -which describes the multiple directives necessary to activate remote -logging. -Along with these other directives, the system can be configured -to forward its logs to a particular log server by -adding or correcting one of the following lines, -substituting appropriately. -The choice of protocol depends on the environment of the system; -although TCP and RELP provide more reliable message delivery, -they may not be supported in all environments. - -To use UDP for log message delivery: -*.* @ - -To use TCP for log message delivery: -*.* @@ - -To use RELP for log message delivery: -*.* :omrelp: - -There must be a resolvable DNS CNAME or Alias record set to "" for logs to be sent correctly to the centralized logging utility. - It is important to configure queues in case the client is sending log -messages to a remote server. If queues are not configured, -the system will stop functioning when the connection -to the remote server is not available. Please consult Rsyslog -documentation for more information about configuration of queues. The -example configuration which should go into /etc/rsyslog.conf -can look like the following lines: - -$ActionQueueType LinkedList -$ActionQueueFileName queuefilename -$ActionQueueMaxDiskSpace 1g -$ActionQueueSaveOnShutdown on -$ActionResumeRetryCount -1 - - BP28(R7) - NT28(R43) - NT12(R5) - 1 - 13 - 14 - 15 - 16 - 2 - 3 - 5 - 6 - APO11.04 - APO13.01 - BAI03.05 - BAI04.04 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000366 - CCI-001348 - CCI-000136 - CCI-001851 - 164.308(a)(1)(ii)(D) - 164.308(a)(5)(ii)(B) - 164.308(a)(5)(ii)(C) - 164.308(a)(6)(ii) - 164.308(a)(8) - 164.310(d)(2)(iii) - 164.312(b) - 164.314(a)(2)(i)(C) - 164.314(a)(2)(iii) - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - SR 7.1 - SR 7.2 - 0988 - 1405 - A.12.1.3 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.17.2.1 - CIP-003-8 R5.2 - CIP-004-6 R3.3 - CM-6(a) - AU-4(1) - AU-9(2) - PR.DS-4 - PR.PT-1 - FAU_GEN.1.1.c - SRG-OS-000479-GPOS-00224 - SRG-OS-000480-GPOS-00227 - SRG-OS-000342-GPOS-00133 - SRG-OS-000032-VMM-000130 - A log server (loghost) receives syslog messages from one or more -systems. This data can be used as an additional log source in the event a -system is compromised and its local logs are suspect. Forwarding log messages -to a remote loghost also provides system administrators with a centralized -place to view the status of multiple hosts within the enterprise. - - - - - - - - - - - - Network Configuration and Firewalls - Most systems must be connected to a network of some -sort, and this brings with it the substantial risk of network -attack. This section discusses the security impact of decisions -about networking which must be made when configuring a system. - -This section also discusses firewalls, network access -controls, and other network security frameworks, which allow -system-level rules to be written that can limit an attackers' ability -to connect to your system. These rules can specify that network -traffic should be allowed or denied from certain IP addresses, -hosts, and networks. The rules can also specify which of the -system's network services are available to particular hosts or -networks. - - Prevent non-Privileged Users from Modifying Network Interfaces using nmcli - By default, non-privileged users are given permissions to modify networking -interfaces and configurations using the nmcli command. Non-privileged -users should not be making configuration changes to network configurations. To -ensure that non-privileged users do not have permissions to make changes to the -network configuration using nmcli, create the following configuration in -/etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla: - -[Disable General User Access to NetworkManager] -Identity=default -Action=org.freedesktop.NetworkManager.* -ResultAny=no -ResultInactive=no -ResultActive=auth_admin - - 3.1.16 - 0418 - 1055 - 1402 - AC-18(4) - CM-6(a) - Allowing non-privileged users to make changes to network settings can allow -untrusted access, prevent system availability, and/or can lead to a compromise or -attack. - - CCE-82696-6 - - - - - - - - - firewalld - The dynamic firewall daemon firewalld provides a -dynamically managed firewall with support for network “zones” to assign -a level of trust to a network and its associated connections and interfaces. -It has support for IPv4 and IPv6 firewall settings. It supports Ethernet -bridges and has a separation of runtime and permanent configuration options. -It also has an interface for services or applications to add firewall rules -directly. - -A graphical configuration tool, firewall-config, is used to configure -firewalld, which in turn uses iptables tool to communicate -with Netfilter in the kernel which implements packet filtering. - -The firewall service provided by firewalld is dynamic rather than -static because changes to the configuration can be made at anytime and are -immediately implemented. There is no need to save or apply the changes. No -unintended disruption of existing network connections occurs as no part of -the firewall has to be reloaded. - - - Inspect and Activate Default firewalld Rules - Firewalls can be used to separate networks into different zones -based on the level of trust the user has decided to place on the devices and -traffic within that network. NetworkManager informs firewalld to which -zone an interface belongs. An interface's assigned zone can be changed by -NetworkManager or via the firewall-config tool. - -The zone settings in /etc/firewalld/ are a range of preset settings -which can be quickly applied to a network interface. These are the zones -provided by firewalld sorted according to the default trust level of the -zones from untrusted to trusted: -dropAny incoming network packets are dropped, there is no -reply. Only outgoing network connections are possible.blockAny incoming network connections are rejected with an -icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited -for IPv6. Only network connections initiated from within the system are -possible.publicFor use in public areas. You do not trust the other -computers on the network to not harm your computer. Only selected incoming -connections are accepted.externalFor use on external networks with masquerading enabled -especially for routers. You do not trust the other computers on the network to -not harm your computer. Only selected incoming connections are accepted.dmzFor computers in your demilitarized zone that are -publicly-accessible with limited access to your internal network. Only selected -incoming connections are accepted.workFor use in work areas. You mostly trust the other computers -on networks to not harm your computer. Only selected incoming connections are -accepted.homeFor use in home areas. You mostly trust the other computers -on networks to not harm your computer. Only selected incoming connections are -accepted.internalFor use on internal networks. You mostly trust the -other computers on the networks to not harm your computer. Only selected -incoming connections are accepted.trustedAll network connections are accepted. - -It is possible to designate one of these zones to be the default zone. When -interface connections are added to NetworkManager, they are assigned -to the default zone. On installation, the default zone in firewalld is set to -be the public zone. - -To find out all the settings of a zone, for example the public zone, -enter the following command as root: -# firewall-cmd --zone=public --list-all -Example output of this command might look like the following: - -# firewall-cmd --zone=public --list-all -public - interfaces: - services: mdns dhcpv6-client ssh - ports: - forward-ports: - icmp-blocks: source-quench - -To view the network zones currently active, enter the following command as root: -# firewall-cmd --get-service -The following listing displays the result of this command -on common Red Hat Enterprise Linux CoreOS 4 system: - -# firewall-cmd --get-service -amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp -high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd -ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn -pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind -samba samba-client smtp ssh telnet tftp tftp-client transmission-client -vnc-server wbem-https - -Finally to view the network zones that will be active after the next firewalld -service reload, enter the following command as root: -# firewall-cmd --get-service --permanent - - - Install firewalld Package - The firewalld package can be installed with the following command: - - CCI-002314 - CM-6(a) - FMT_SMF_EXT.1 - SRG-OS-000096-GPOS-00050 - SRG-OS-000297-GPOS-00115 - SRG-OS-000298-GPOS-00116 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-GPOS-00232 - "Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. - -Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. - -Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. - -Red Hat Enterprise Linux CoreOS 4 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. -Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)." - - CCE-82521-6 - - - - - - - - - Verify firewalld Enabled - -The firewalld service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-firewalld-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: firewalld.service - enabled: true - - -This will enable the firewalld service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - 3.1.3 - 3.4.7 - CCI-000366 - CCI-000382 - CCI-002314 - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - CIP-003-8 R4 - CIP-003-8 R5 - CIP-004-6 R3 - AC-4 - CM-7(b) - CA-3(5) - SC-7(21) - CM-6(a) - PR.IP-1 - FMT_SMF_EXT.1 - SRG-OS-000096-GPOS-00050 - SRG-OS-000297-GPOS-00115 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-GPOS-00231 - SRG-OS-000480-GPOS-00232 - Access control methods provide the ability to enhance system security posture -by restricting services and known good IP addresses and address ranges. This -prevents connections from unknown hosts and protocols. - - CCE-82554-7 - - - - - - - - - - Strengthen the Default Ruleset - The default rules can be strengthened. The system -scripts that activate the firewall rules expect them to be defined -in configuration files under the /etc/firewalld/services -and /etc/firewalld/zones directories. - -The following recommendations describe how to strengthen the -default ruleset configuration file. An alternative to editing this -configuration file is to create a shell script that makes calls to -the firewall-cmd program to load in rules under the /etc/firewalld/services -and /etc/firewalld/zones directories. - -Instructions apply to both unless otherwise noted. Language and address -conventions for regular firewalld rules are used throughout this section. - The program firewall-config -allows additional services to penetrate the default firewall rules -and automatically adjusts the firewalld ruleset(s). - - - - - IPSec Support - Support for Internet Protocol Security (IPsec) -is provided with Libreswan. - - Install libreswan Package - The Libreswan package provides an implementation of IPsec -and IKE, which permits the creation of secure tunnels over -untrusted networks. The libreswan package can be installed with the following command: - - 12 - 15 - 3 - 5 - 8 - APO13.01 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.04 - CCI-001130 - CCI-001131 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - SR 1.13 - SR 2.6 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.4 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.15.1.1 - A.15.2.1 - A.6.2.1 - A.6.2.2 - CM-6(a) - PR.AC-3 - PR.MA-2 - PR.PT-4 - Req-4.1 - SRG-OS-000480-GPOS-00227 - SRG-OS-000120-GPOS-00061 - Providing the ability for remote users or systems -to initiate a secure VPN connection protects information when it is -transmitted over a wide area network. - CCE-82525-7 - - - - - - - - - - iptables and ip6tables - A host-based firewall called netfilter is included as -part of the Linux kernel distributed with the system. It is -activated by default. This firewall is controlled by the program -iptables, and the entire capability is frequently referred to by -this name. An analogous program called ip6tables handles filtering -for IPv6. - -Unlike TCP Wrappers, which depends on the network server -program to support and respect the rules written, netfilter -filtering occurs at the kernel level, before a program can even -process the data from the network packet. As such, any program on -the system is affected by the rules written. - -This section provides basic information about strengthening -the iptables and ip6tables configurations included with the system. -For more complete information that may allow the construction of a -sophisticated ruleset tailored to your environment, please consult -the references at the end of this section. - - Install iptables Package - The iptables package can be installed with the following command: - - CM-6(a) - SRG-OS-000480-GPOS-00227 - iptables controls the Linux kernel network packet filtering -code. iptables allows system operators to set up firewalls and IP -masquerading, etc. - CCE-82522-4 - - - - - - - - - Inspect and Activate Default Rules - View the currently-enforced iptables rules by running -the command: -$ sudo iptables -nL --line-numbers -The command is analogous for ip6tables. - -If the firewall does not appear to be active (i.e., no rules -appear), activate it and ensure that it starts at boot by issuing -the following commands (and analogously for ip6tables): -$ sudo service iptables restart -The default iptables rules are: -Chain INPUT (policy ACCEPT) -num target prot opt source destination -1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED -2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 -3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 -4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 -5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited - -Chain FORWARD (policy ACCEPT) -num target prot opt source destination -1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited - -Chain OUTPUT (policy ACCEPT) -num target prot opt source destination -The ip6tables default rules are essentially the same. - - Verify ip6tables Enabled if Using IPv6 - -The ip6tables service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-ip6tables-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: ip6tables.service - enabled: true - - -This will enable the ip6tables service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 4 - 6 - 8 - 9 - APO01.06 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R4 - CIP-003-8 R5 - CIP-004-6 R3 - AC-4 - CM-7(b) - CA-3(5) - SC-7(21) - CM-6(a) - DE.AE-1 - ID.AM-3 - PR.AC-5 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - The ip6tables service provides the system's host-based firewalling -capability for IPv6 and ICMPv6. - - - - - - - - - - Verify iptables Enabled - -The iptables service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-iptables-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: iptables.service - enabled: true - - -This will enable the iptables service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 4 - 6 - 8 - 9 - APO01.06 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R4 - CIP-003-8 R5 - CIP-004-6 R3 - AC-4 - CM-7(b) - CA-3(5) - SC-7(21) - CM-6(a) - DE.AE-1 - ID.AM-3 - PR.AC-5 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - The iptables service provides the system's host-based firewalling -capability for IPv4 and ICMP. - - - - - - - - - - Set Default ip6tables Policy for Incoming Packets - To set the default policy to DROP (instead of ACCEPT) for -the built-in INPUT chain which processes incoming packets, -add or correct the following line in -/etc/sysconfig/ip6tables: -:INPUT DROP [0:0] -If changes were required, reload the ip6tables rules: -$ sudo service ip6tables reload - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CIP-003-8 R4 - CIP-003-8 R5 - CIP-004-6 R3 - AC-4 - CM-7(b) - CA-3(5) - SC-7(21) - CM-6(a) - PR.IP-1 - PR.PT-3 - In ip6tables, the default policy is applied only after all -the applicable rules in the table are examined for a match. Setting the -default policy to DROP implements proper design for a firewall, i.e. -any packets which are not explicitly permitted should not be -accepted. - - - - - - - Strengthen the Default Ruleset - The default rules can be strengthened. The system -scripts that activate the firewall rules expect them to be defined -in the configuration files iptables and ip6tables in the directory -/etc/sysconfig. Many of the lines in these files are similar -to the command line arguments that would be provided to the programs -/sbin/iptables or /sbin/ip6tables - but some are quite -different. - -The following recommendations describe how to strengthen the -default ruleset configuration file. An alternative to editing this -configuration file is to create a shell script that makes calls to -the iptables program to load in rules, and then invokes service -iptables save to write those loaded rules to -/etc/sysconfig/iptables. - -The following alterations can be made directly to -/etc/sysconfig/iptables and /etc/sysconfig/ip6tables. -Instructions apply to both unless otherwise noted. Language and address -conventions for regular iptables are used throughout this section; -configuration for ip6tables will be either analogous or explicitly -covered. - The program system-config-securitylevel -allows additional services to penetrate the default firewall rules -and automatically adjusts /etc/sysconfig/iptables. This program -is only useful if the default ruleset meets your security -requirements. Otherwise, this program should not be used to make -changes to the firewall configuration because it re-writes the -saved configuration file. - - Set Default iptables Policy for Incoming Packets - To set the default policy to DROP (instead of ACCEPT) for -the built-in INPUT chain which processes incoming packets, -add or correct the following line in -/etc/sysconfig/iptables: -:INPUT DROP [0:0] - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CA-3(5) - CM-7(b) - SC-7(23) - CM-6(a) - PR.IP-1 - PR.PT-3 - In iptables the default policy is applied only after all -the applicable rules in the table are examined for a match. Setting the -default policy to DROP implements proper design for a firewall, i.e. -any packets which are not explicitly permitted should not be -accepted. - - - - - - Set Default iptables Policy for Forwarded Packets - To set the default policy to DROP (instead of ACCEPT) for -the built-in FORWARD chain which processes packets that will be forwarded from -one interface to another, -add or correct the following line in -/etc/sysconfig/iptables: -:FORWARD DROP [0:0] - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CA-3(5) - CM-7(b) - SC-7(23) - CM-6(a) - PR.IP-1 - PR.PT-3 - In iptables, the default policy is applied only after all -the applicable rules in the table are examined for a match. Setting the -default policy to DROP implements proper design for a firewall, i.e. -any packets which are not explicitly permitted should not be -accepted. - - - - - - Restrict ICMP Message Types - In /etc/sysconfig/iptables, the accepted ICMP messages -types can be restricted. To accept only ICMP echo reply, destination -unreachable, and time exceeded messages, remove the line: --A INPUT -p icmp --icmp-type any -j ACCEPT -and insert the lines: --A INPUT -p icmp --icmp-type echo-reply -j ACCEPT --A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT --A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT -To allow the system to respond to pings, also insert the following line: --A INPUT -p icmp --icmp-type echo-request -j ACCEPT -Ping responses can also be limited to certain networks or hosts by using the -s -option in the previous rule. Because IPv6 depends so heavily on ICMPv6, it is -preferable to deny the ICMPv6 packets you know you don't need (e.g. ping -requests) in /etc/sysconfig/ip6tables, while letting everything else -through: --A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP -If you are going to statically configure the system's address, it should -ignore Router Advertisements which could add another IPv6 address to the -interface or alter important network settings: --A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP -Restricting ICMPv6 message types in /etc/sysconfig/ip6tables is not -recommended because the operation of IPv6 depends heavily on ICMPv6. Thus, great -care must be taken if any other ICMPv6 types are blocked. - - - Log and Drop Packets with Suspicious Source Addresses - Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the -modified policy will reject non-matching packets, you only need to add these rules if you are interested in also -logging these spoofing or suspicious attempts before they are dropped. If you do choose to log various suspicious -traffic, add identical rules with a target of DROP after each LOG. -To log and then drop these IPv4 packets, insert the following rules in /etc/sysconfig/iptables (excepting -any that are intentionally used): --A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: " --A INPUT -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: " --A INPUT -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: " --A INPUT -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: " --A INPUT -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: " --A INPUT -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: " -Similarly, you might wish to log packets containing some IPv6 reserved addresses if they are not expected -on your network: --A INPUT -i eth0 -s ::1 -j LOG --log-prefix "IPv6 DROP LOOPBACK: " --A INPUT -s 2002:E000::/20 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: " --A INPUT -s 2002:7F00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: " --A INPUT -s 2002:0000::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: " --A INPUT -s 2002:FF00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: " --A INPUT -s 2002:0A00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: " --A INPUT -s 2002:AC10::/28 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: " --A INPUT -s 2002:C0A8::/32 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: " -If you are not expecting to see site-local multicast or auto-tunneled traffic, you can log those: --A INPUT -s FF05::/16 -j LOG --log-prefix "IPv6 SITE-LOCAL MULTICAST: " --A INPUT -s ::0.0.0.0/96 -j LOG --log-prefix "IPv4 COMPATIBLE IPv6 ADDR: " -If you wish to block multicasts to all link-local nodes (e.g. if you are not using router auto-configuration and -do not plan to have any services that multicast to the entire local network), you can block the link-local -all-nodes multicast address (before accepting incoming ICMPv6): --A INPUT -d FF02::1 -j LOG --log-prefix "Link-local All-Nodes Multicast: " -However, if you're going to allow IPv4 compatible IPv6 addresses (of the form ::0.0.0.0/96), you should -then consider logging the non-routable IPv4-compatible addresses: --A INPUT -s ::0.0.0.0/104 -j LOG --log-prefix "IP NON-ROUTABLE ADDR: " --A INPUT -s ::127.0.0.0/104 -j LOG --log-prefix "IP DROP LOOPBACK: " --A INPUT -s ::224.0.0.0.0/100 -j LOG --log-prefix "IP DROP MULTICAST D: " --A INPUT -s ::255.0.0.0/104 -j LOG --log-prefix "IP BROADCAST: " -If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your network, consider logging it before it gets dropped: --A INPUT -s ::FFFF:0.0.0.0/96 -j LOG --log-prefix "IPv4 MAPPED IPv6 ADDR: " --A INPUT -s 2002::/16 -j LOG --log-prefix "IPv6 6to4 ADDR: " -The following rule will log all traffic originating from a site-local address, which is deprecated address space: --A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: " - - - - - IPv6 - The system includes support for Internet Protocol -version 6. A major and often-mentioned improvement over IPv4 is its -enormous increase in the number of available addresses. Another -important feature is its support for automatic configuration of -many network settings. - - Disable Support for IPv6 Unless Needed - Despite configuration that suggests support for IPv6 has -been disabled, link-local IPv6 address auto-configuration occurs -even when only an IPv4 address is assigned. The only way to -effectively prevent execution of the IPv6 networking stack is to -instruct the system not to activate the IPv6 kernel module. - - Ensure IPv6 is disabled through kernel boot parameter - To disable IPv6 protocol support in the Linux kernel, -add the argument ipv6.disable=1 to the default -GRUB2 command line for the Linux operating system. -Configure the default Grub2 kernel command line to contain ipv6.disable=1 as follows: -# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1" - Any unnecessary network stacks, including IPv6, should be disabled to reduce -the vulnerability to exploitation. - - - - - - - - - - Disable IPv6 Networking Support Automatic Loading - To prevent the IPv6 kernel module (ipv6) from binding to the -IPv6 networking stack, add the following line to -/etc/modprobe.d/disabled.conf (or another file in -/etc/modprobe.d): -options ipv6 disable=1 -This permits the IPv6 module to be loaded (and thus satisfy other modules that -depend on it), while disabling support for the IPv6 protocol. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Any unnecessary network stacks - including IPv6 - should be disabled, to reduce -the vulnerability to exploitation. - - - - - - - - - - Disable IPv6 Addressing on All IPv6 Interfaces - To disable support for (ipv6) addressing on all interface add the following line to -/etc/sysctl.d/ipv6.conf (or another file in /etc/sysctl.d): -net.ipv6.conf.all.disable_ipv6 = 1 -This disables IPv6 on all network interfaces as other services and system -functionality require the IPv6 stack loaded to work. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.1.20 - CCI-001551 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Any unnecessary network stacks - including IPv6 - should be disabled, to reduce -the vulnerability to exploitation. - - - - - - - - - - Disable IPv6 Addressing on IPv6 Interfaces by Default - To disable support for (ipv6) addressing on interfaces by default add the following line to -/etc/sysctl.d/ipv6.conf (or another file in /etc/sysctl.d): -net.ipv6.conf.default.disable_ipv6 = 1 -This disables IPv6 on network interfaces by default as other services and system -functionality require the IPv6 stack loaded to work. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.1.20 - CCI-001551 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Any unnecessary network stacks - including IPv6 - should be disabled, to reduce -the vulnerability to exploitation. - - - - - - - - - - - Configure IPv6 Settings if Necessary - A major feature of IPv6 is the extent to which systems -implementing it can automatically configure their networking -devices using information from the network. From a security -perspective, manually configuring important configuration -information is preferable to accepting it from the network -in an unauthenticated fashion. - - IPV6_AUTOCONF - Toggle global IPv6 auto-configuration (only, if global -forwarding is disabled) - no - no - yes - - - net.ipv6.conf.all.accept_ra_defrtr - Accept default router in router advertisements? - 0 - 0 - 1 - - - net.ipv6.conf.all.accept_ra_pinfo - Accept prefix information in router advertisements? - 0 - 0 - 1 - - - net.ipv6.conf.all.accept_ra_rtr_pref - Accept router preference in router advertisements? - 0 - 0 - 1 - - - net.ipv6.conf.all.accept_ra - Accept all router advertisements? - 0 - 0 - 1 - - - net.ipv6.conf.all.accept_redirects - Toggle ICMP Redirect Acceptance - 0 - 0 - 1 - - - net.ipv6.conf.all.accept_source_route - Trackers could be using source-routed packets to -generate traffic that seems to be intra-net, but actually was -created outside and has been redirected. - 0 - 0 - 1 - - - net.ipv6.conf.all.autoconf - Enable auto configuration on IPv6 interfaces - 0 - 0 - 1 - - - net.ipv6.conf.all.forwarding - Toggle IPv6 Forwarding - 0 - 0 - 1 - - - net.ipv6.conf.all.max_addresses - Maximum number of autoconfigured IPv6 addresses - 1 - - - net.ipv6.conf.all.router_solicitations - Accept all router solicitations? - 0 - 0 - 1 - - - net.ipv6.conf.default.accept_ra_defrtr - Accept default router in router advertisements? - 0 - 0 - 1 - - - net.ipv6.conf.default.accept_ra_pinfo - Accept prefix information in router advertisements? - 0 - 0 - 1 - - - net.ipv6.conf.default.accept_ra_rtr_pref - Accept router preference in router advertisements? - 0 - 0 - 1 - - - net.ipv6.conf.default.accept_ra - Accept default router advertisements by default? - 0 - 0 - 1 - - - net.ipv6.conf.default.accept_redirects - Toggle ICMP Redirect Acceptance By Default - 0 - 0 - 1 - - - net.ipv6.conf.default.accept_source_route - Trackers could be using source-routed packets to -generate traffic that seems to be intra-net, but actually was -created outside and has been redirected. - 0 - 0 - 1 - - - net.ipv6.conf.default.autoconf - Enable auto configuration on IPv6 interfaces - 0 - 0 - 1 - - - net.ipv6.conf.default.forwarding - Toggle IPv6 default Forwarding - 0 - 0 - 1 - - - net.ipv6.conf.default.max_addresses - Maximum number of autoconfigured IPv6 addresses - 1 - - - net.ipv6.conf.default.router_solicitations - Accept all router solicitations by default? - 0 - 0 - 1 - - - Disable Automatic Configuration - Disable the system's acceptance of router -advertisements and redirects by adding or correcting the following -line in /etc/sysconfig/network (note that this does not disable -sending router solicitations): -IPV6_AUTOCONF=no - TBD - - - Configure Accepting Router Advertisements on All IPv6 Interfaces - To set the runtime status of the net.ipv6.conf.all.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_ra = 0 - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.1.20 - CCI-000366 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - An illicit router advertisement message could result in a man-in-the-middle attack. - - CCE-82467-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv6.conf.all.accept_ra%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_all_accept_ra.conf - overwrite: true - - - - - - - - - - - Disable Accepting ICMP Redirects for All IPv6 Interfaces - To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_redirects = 0 - BP28(R22) - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.1.20 - CCI-000366 - CCI-001551 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - CM-6(b) - CM-6.1(iv) - PR.IP-1 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - An illicit ICMP redirect message could result in a man-in-the-middle attack. - - CCE-82471-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv6.conf.all.accept_redirects%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_all_accept_redirects.conf - overwrite: true - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces - To set the runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_source_route = 0 - BP28(R22) - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 4 - 6 - 8 - 9 - APO01.06 - APO13.01 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.20 - CCI-000366 - 4.2.3.4 - 4.3.3.4 - 4.4.3.3 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-7(a) - CM-7(b) - CM-6(a) - DE.AE-1 - ID.AM-3 - PR.AC-5 - PR.DS-5 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Source-routed packets allow the source of the packet to suggest routers -forward the packet along a different path than configured on the router, which can -be used to bypass network security measures. This requirement applies only to the -forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and -the system is functioning as a router. - -Accepting source-routed packets in the IPv6 protocol has few legitimate -uses. It should be disabled unless it is absolutely required. - - CCE-82480-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv6.conf.all.accept_source_route%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_all_accept_source_route.conf - overwrite: true - - - - - - - - - - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default - To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_ra = 0 - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.1.20 - CCI-000366 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - An illicit router advertisement message could result in a man-in-the-middle attack. - - CCE-82468-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv6.conf.default.accept_ra%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_default_accept_ra.conf - overwrite: true - - - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces - To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_redirects = 0 - BP28(R22) - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.1.20 - CCI-000366 - CCI-001551 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - An illicit ICMP redirect message could result in a man-in-the-middle attack. - - CCE-82477-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv6.conf.default.accept_redirects%20%3D%200%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_default_accept_redirects.conf - overwrite: true - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default - To set the runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_source_route = 0 - BP28(R22) - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 4 - 6 - 8 - 9 - APO01.06 - APO13.01 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.20 - CCI-000366 - 4.2.3.4 - 4.3.3.4 - 4.4.3.3 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-7(a) - CM-7(b) - CM-6(a) - CM-6(b) - CM-6.1(iv) - DE.AE-1 - ID.AM-3 - PR.AC-5 - PR.DS-5 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Source-routed packets allow the source of the packet to suggest routers -forward the packet along a different path than configured on the router, which can -be used to bypass network security measures. This requirement applies only to the -forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and -the system is functioning as a router. - -Accepting source-routed packets in the IPv6 protocol has few legitimate -uses. It should be disabled unless it is absolutely required. - - CCE-82481-3 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv6.conf.default.accept_source_route%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_default_accept_source_route.conf - overwrite: true - - - - - - - - - - - Limit Network-Transmitted Configuration if Using Static IPv6 Addresses - To limit the configuration information requested from other -systems and accepted from the network on a system that uses -statically-configured IPv6 addresses, add the following lines to -/etc/sysctl.conf: -net.ipv6.conf.default.router_solicitations = 0 -net.ipv6.conf.default.accept_ra_rtr_pref = 0 -net.ipv6.conf.default.accept_ra_pinfo = 0 -net.ipv6.conf.default.accept_ra_defrtr = 0 -net.ipv6.conf.default.autoconf = 0 -net.ipv6.conf.default.dad_transmits = 0 -net.ipv6.conf.default.max_addresses = 1 -The router_solicitations setting determines how many router -solicitations are sent when bringing up the interface. If addresses are -statically assigned, there is no need to send any solicitations. - -The accept_ra_pinfo setting controls whether the system will accept -prefix info from the router. - -The accept_ra_defrtr setting controls whether the system will accept -Hop Limit settings from a router advertisement. Setting it to 0 prevents a -router from changing your default IPv6 Hop Limit for outgoing packets. - -The autoconf setting controls whether router advertisements can cause -the system to assign a global unicast address to an interface. - -The dad_transmits setting determines how many neighbor solicitations -to send out per address (global and link-local) when bringing up an interface -to ensure the desired address is unique on the network. - -The max_addresses setting determines how many global unicast IPv6 -addresses can be assigned to each interface. The default is 16, but it should -be set to exactly the number of statically configured global addresses -required. - - - - - Kernel Parameters Which Affect Networking - The sysctl utility is used to set -parameters which affect the operation of the Linux kernel. Kernel parameters -which affect networking and have security implications are described here. - - Network Related Kernel Runtime Parameters for Hosts and Routers - Certain kernel parameters should be set for systems which are -acting as either hosts or routers to improve the system's ability defend -against certain types of IPv4 protocol attacks. - - - net.ipv4.conf.all.accept_redirects - Disable ICMP Redirect Acceptance - 0 - 0 - 1 - - - net.ipv4.conf.all.accept_source_route - Trackers could be using source-routed packets to -generate traffic that seems to be intra-net, but actually was -created outside and has been redirected. - 0 - 0 - 1 - - - net.ipv4.conf.default.arp_filter - Controls whether the ARP filter is enabled or not. - -1 - Allows you to have multiple network interfaces on the same subnet, and have the ARPs for each -interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that interface. -In other words it allows control of which cards (usually 1) will respond to an ARP request. - -0 - (default) The kernel can respond to arp requests with addresses from other interfaces. -This may seem wrong but it usually makes sense, because it increases the chance of successful communication. -IP addresses are owned by the complete host on Linux, not by particular interfaces. - 0 - 0 - 1 - - - net.ipv4.conf.default.arp_ignore - Control the response modes for ARP queries that resolve local target IP addresses: - -0 - (default): reply for any local target IP address, configured on any interface -1 - reply only if the target IP address is local address configured on the incoming interface -2 - reply only if the target IP address is local address configured on the incoming interface and both with the sender’s IP address are part from same subnet on this interface -3 - do not reply for local addresses configured with scope host, only resolutions for global and link addresses are replied -4-7 - reserved -8 - do not reply for all local addresses - 0 - 0 - 1 - 2 - 3 - 8 - - - net.ipv4.conf.all.forwarding - Toggle IPv4 Forwarding - 0 - 0 - 1 - - - net.ipv4.conf.all.log_martians - Disable so you don't Log Spoofed Packets, Source -Routed Packets, Redirect Packets - 1 - 0 - 1 - - - net.ipv4.conf.all.rp_filter - Enable to enforce sanity checking, also called ingress -filtering or egress filtering. The point is to drop a packet if the -source and destination IP addresses in the IP header do not make -sense when considered in light of the physical interface on which -it arrived. - 1 - 1 - 2 - - - net.ipv4.conf.all.secure_redirects - Enable to prevent hijacking of routing path by only -allowing redirects from gateways known in routing -table. Disable to refuse acceptance of secure ICMP redirected packets on all interfaces. - 0 - 0 - 1 - - - net.ipv4.conf.all.shared_media - Controls whether the system can send (router) or accept (host) RFC1620 shared media redirects. -shared_media for the interface will be enabled if at least one of conf/{all,interface}/shared_media -is set to TRUE, it will be disabled otherwise. - 0 - 0 - 1 - - - net.ipv4.conf.default.accept_redirects - Disable ICMP Redirect Acceptance? - 0 - 0 - 1 - - - net.ipv4.conf.default.accept_source_route - Disable IP source routing? - 0 - 0 - 1 - - - net.ipv4.conf.default.log_martians - Disable so you don't Log Spoofed Packets, Source -Routed Packets, Redirect Packets - 1 - 0 - 1 - - - net.ipv4.conf.default.rp_filter - Enables source route verification - 1 - 0 - 1 - - - net.ipv4.conf.default.secure_redirects - Enable to prevent hijacking of routing path by only -allowing redirects from gateways known in routing -table. Disable to refuse acceptance of secure ICMP redirected packages by default. - 0 - 0 - 1 - - - net.ipv4.conf.default.shared_media - Controls whether the system can send(router) or accept(host) RFC1620 shared media redirects. -shared_media for the interface will be enabled if at least one of conf/{all,interface}/shared_media -is set to TRUE, it will be disabled otherwise. - 0 - 0 - 1 - - - net.ipv4.icmp_echo_ignore_broadcasts - Ignore all ICMP ECHO and TIMESTAMP requests sent to it -via broadcast/multicast - 1 - 0 - 1 - - - net.ipv4.icmp_ignore_bogus_error_responses - Enable to prevent unnecessary logging - 1 - 0 - 1 - - - net.ipv4.tcp_invalid_ratelimit - Configure the maximal rate for sending duplicate acknowledgments in -response to incoming invalid TCP packets. - 500 - 1000 - 500 - 250 - 100 - - - net.ipv4.tcp_rfc1337 - Enable to enable TCP behavior conformant with RFC 1337 - 1 - 0 - 1 - - - net.ipv4.tcp_syncookies - Enable to turn on TCP SYN Cookie -Protection - 1 - 0 - 1 - - - Disable Accepting Packets Routed Between Local Interfaces - To set the runtime status of the net.ipv4.conf.all.accept_local kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_local=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.accept_local = 0 - Configure net.ipv4.conf.all.accept_local=0 to consider as invalid the packets -received from outside whose source is the 127.0.0.0/8 address block. -In combination with suitable routing, this can be used to direct packets between two -local interfaces over the wire and have them accepted properly. - - - - - - - - - - Disable Accepting ICMP Redirects for All IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.accept_redirects = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 7 - 8 - 9 - 5.10.1.1 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.05 - DSS05.07 - DSS06.06 - 3.1.20 - CCI-000366 - CCI-001503 - CCI-001551 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - SC-7(a) - DE.CM-1 - PR.DS-4 - PR.IP-1 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - ICMP redirect messages are used by routers to inform hosts that a more -direct route exists for a particular destination. These messages modify the -host's route table and are unauthenticated. An illicit ICMP redirect -message could result in a man-in-the-middle attack. - -This feature of the IPv4 protocol has few legitimate uses. It should be -disabled unless absolutely required." - - CCE-82469-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.all.accept_redirects%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_redirects.conf - overwrite: true - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.accept_source_route = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-000366 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - CM-6(a) - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Source-routed packets allow the source of the packet to suggest routers -forward the packet along a different path than configured on the router, -which can be used to bypass network security measures. This requirement -applies only to the forwarding of source-routerd traffic, such as when IPv4 -forwarding is enabled and the system is functioning as a router. - -Accepting source-routed packets in the IPv4 protocol has few legitimate -uses. It should be disabled unless it is absolutely required. - - CCE-82478-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.all.accept_source_route%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_source_route.conf - overwrite: true - - - - - - - - - - - Configure ARP filtering for All IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.arp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.arp_filter= -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.arp_filter = - This behaviour may cause problems to system on a high availability or load balancing configuration. - Prevents the Linux Kernel from handling the ARP table globally. -By default, the kernel may respond to an ARP request from a certain interface with information -from another interface. - - - - - - - - - - - Configure Response Mode of ARP Requests for All IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.arp_ignore kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.arp_ignore= -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.arp_ignore = - The ARP response mode may impact behaviour of workloads and firewalls on the system. - Avoids ARP Flux on system that have more than one interface on the same subnet. - - - - - - - - - - - Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.log_martians=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.log_martians = 1 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 7 - 8 - 9 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.04 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.05 - DSS05.07 - DSS06.06 - 3.1.20 - CCI-000126 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.2.1 - A.6.2.2 - A.9.1.2 - CM-7(a) - CM-7(b) - SC-5(3)(a) - DE.CM-1 - PR.AC-3 - PR.DS-4 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - The presence of "martian" packets (which have impossible addresses) -as well as spoofed packets, source-routed packets, and redirects could be a -sign of nefarious network activity. Logging these packets enables this activity -to be detected. - - CCE-82486-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.all.log_martians%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_log_martians.conf - overwrite: true - - - - - - - - - - - Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.route_localnet kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.route_localnet=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.route_localnet = 0 - Refuse the routing of packets whose source or destination address is the local loopback. -This prohibits the use of network 127/8 for local routing purposes. -Enabling route_localnet can expose applications listening on localhost to external traffic. - - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.rp_filter = 1 - BP28(R22) - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 4 - 6 - 7 - 8 - 9 - APO01.06 - APO13.01 - BAI04.04 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.20 - CCI-000366 - CCI-001551 - 4.2.3.4 - 4.3.3.4 - 4.4.3.3 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-7(a) - CM-7(b) - CM-6(a) - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Enabling reverse path filtering drops packets with source addresses -that should not have been able to be received on the interface they were -received on. It should not be used on systems which are routers for -complicated networks, but is helpful for end hosts and routers serving small -networks. - - CCE-82488-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.all.rp_filter%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_rp_filter.conf - overwrite: true - - - - - - - - - - - Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.secure_redirects = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-001503 - CCI-001551 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-7(a) - CM-7(b) - CM-6(a) - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Accepting "secure" ICMP redirects (from those gateways listed as -default gateways) has few legitimate uses. It should be disabled unless it is -absolutely required. - - CCE-82482-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.all.secure_redirects%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_secure_redirects.conf - overwrite: true - - - - - - - - - - - Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.shared_media kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.shared_media= -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.shared_media = - This setting should be aligned with net.ipv4.conf.all.secure_redirects because it overrides it. -If shared_media is enabled for an interface secure_redirects will be enabled too. - - - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.accept_redirects = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - 5.10.1.1 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-000366 - CCI-001551 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-7(a) - CM-7(b) - CM-6(a) - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - ICMP redirect messages are used by routers to inform hosts that a more -direct route exists for a particular destination. These messages modify the -host's route table and are unauthenticated. An illicit ICMP redirect -message could result in a man-in-the-middle attack. -This feature of the IPv4 protocol has few legitimate uses. It should -be disabled unless absolutely required. - - CCE-82470-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.default.accept_redirects%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_accept_redirects.conf - overwrite: true - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default - To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.accept_source_route = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - 5.10.1.1 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-000366 - CCI-001551 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Source-routed packets allow the source of the packet to suggest routers -forward the packet along a different path than configured on the router, -which can be used to bypass network security measures. - -Accepting source-routed packets in the IPv4 protocol has few legitimate -uses. It should be disabled unless it is absolutely required, such as when -IPv4 forwarding is enabled and the system is legitimately functioning as a -router. - - CCE-82479-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.default.accept_source_route%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_accept_source_route.conf - overwrite: true - - - - - - - - - - - Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default - To set the runtime status of the net.ipv4.conf.default.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.log_martians=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.log_martians = 1 - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 7 - 8 - 9 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.04 - DSS03.05 - DSS05.02 - DSS05.03 - DSS05.05 - DSS05.07 - DSS06.06 - 3.1.20 - CCI-000126 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.2.1 - A.6.2.2 - A.9.1.2 - CM-7(a) - CM-7(b) - SC-5(3)(a) - DE.CM-1 - PR.AC-3 - PR.DS-4 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - The presence of "martian" packets (which have impossible addresses) -as well as spoofed packets, source-routed packets, and redirects could be a -sign of nefarious network activity. Logging these packets enables this activity -to be detected. - - CCE-82487-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.default.log_martians%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_log_martians.conf - overwrite: true - - - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default - To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.rp_filter = 1 - BP28(R22) - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 4 - 6 - 7 - 8 - 9 - APO01.06 - APO13.01 - BAI04.04 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.20 - CCI-000366 - 4.2.3.4 - 4.3.3.4 - 4.4.3.3 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-7(a) - CM-7(b) - CM-6(a) - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Enabling reverse path filtering drops packets with source addresses -that should not have been able to be received on the interface they were -received on. It should not be used on systems which are routers for -complicated networks, but is helpful for end hosts and routers serving small -networks. - - CCE-82489-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.default.rp_filter%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_rp_filter.conf - overwrite: true - - - - - - - - - - - Configure Kernel Parameter for Accepting Secure Redirects By Default - To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.secure_redirects = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-001551 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Accepting "secure" ICMP redirects (from those gateways listed as -default gateways) has few legitimate uses. It should be disabled unless it is -absolutely required. - - CCE-82483-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.default.secure_redirects%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_secure_redirects.conf - overwrite: true - - - - - - - - - - - Configure Sending and Accepting Shared Media Redirects by Default - To set the runtime status of the net.ipv4.conf.default.shared_media kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.shared_media= -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.shared_media = - This setting should be aligned with net.ipv4.conf.default.secure_redirects because it overrides it. -If shared_media is enabled for an interface secure_redirects will be enabled too. - - - - - - - - - - - Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces - To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.icmp_echo_ignore_broadcasts = 1 - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - 5.10.1.1 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-000366 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Responding to broadcast (ICMP) echoes facilitates network mapping -and provides a vector for amplification attacks. - -Ignoring ICMP echo requests (pings) sent to broadcast or multicast -addresses makes the system slightly more difficult to enumerate on the network. - - CCE-82491-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.icmp_echo_ignore_broadcasts%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_icmp_echo_ignore_broadcasts.conf - overwrite: true - - - - - - - - - - - Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces - To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.icmp_ignore_bogus_error_responses = 1 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 7 - 8 - 9 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.05 - DSS05.07 - DSS06.06 - 3.1.20 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.9.1.2 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - DE.CM-1 - PR.DS-4 - PR.IP-1 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - Ignoring bogus ICMP error responses reduces -log size, although some activity would not be logged. - - CCE-82490-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.icmp_ignore_bogus_error_responses%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_icmp_ignore_bogus_error_responses.conf - overwrite: true - - - - - - - - - - - Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments - Make sure that the system is configured to limit the maximal rate for sending -duplicate acknowledgments in response to incoming TCP packets that are for -an existing connection but that are invalid due to any of these reasons: - -(a) out-of-window sequence number, (b) out-of-window acknowledgment number, -or (c) PAWS (Protection Against Wrapped Sequence numbers) check failure -This measure protects against or limits effects of DoS attacks against the system. -Set the system to implement rate-limiting measures by adding the following line to -/etc/sysctl.conf or a configuration file in the /etc/sysctl.d/ directory -(or modify the line to have the required value): -net.ipv4.tcp_invalid_ratelimit = -Issue the following command to make the changes take effect: -# sysctl --system - CCI-002385 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - SC-5 - SRG-OS-000420-GPOS-00186 - SRG-OS-000420-VMM-001690 - Denial of Service (DoS) is a condition when a resource is not available for legitimate users. When -this occurs, the organization either cannot accomplish its mission or must -operate at degraded capacity. - -This can help mitigate simple “ack loop” DoS attacks, wherein a buggy or -malicious middlebox or man-in-the-middle can rewrite TCP header fields in -manner that causes each endpoint to think that the other is sending invalid -TCP segments, thus causing each side to send an unterminating stream of -duplicate acknowledgments for invalid segments. - - - - - - - - - - - Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - To set the runtime status of the net.ipv4.tcp_syncookies kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.tcp_syncookies=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.tcp_syncookies = 1 - BP28(R22) - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 4 - 6 - 7 - 8 - 9 - 5.10.1.1 - APO01.06 - APO13.01 - BAI04.04 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.20 - CCI-000366 - CCI-001095 - 4.2.3.4 - 4.3.3.4 - 4.4.3.3 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-7(a) - CM-7(b) - SC-5(1) - SC-5(2) - SC-5(3)(a) - CM-6(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - SRG-OS-000420-GPOS-00186 - SRG-OS-000142-GPOS-00071 - A TCP SYN flood attack can cause a denial of service by filling a -system's TCP connection table with connections in the SYN_RCVD state. -Syncookies can be used to track a connection when a subsequent ACK is received, -verifying the initiator is attempting a valid connection and is not a flood -source. This feature is activated when a flood condition is detected, and -enables the system to continue servicing valid connection requests. - - CCE-82492-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.tcp_syncookies%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_tcp_syncookies.conf - overwrite: true - - - - - - - - - - - - Network Parameters for Hosts Only - If the system is not going to be used as a router, then setting certain -kernel parameters ensure that the host will not perform routing -of network traffic. - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces - To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.send_redirects = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - 5.10.1.1 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-000366 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - CM-6(a) - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - ICMP redirect messages are used by routers to inform hosts that a more -direct route exists for a particular destination. These messages contain information -from the system's route table possibly revealing portions of the network topology. - -The ability to send ICMP redirects is only appropriate for systems acting as routers. - - CCE-82484-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.all.send_redirects%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_send_redirects.conf - overwrite: true - - - - - - - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default - To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.send_redirects = 0 - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 2 - 3 - 4 - 6 - 7 - 8 - 9 - 5.10.1.1 - APO01.06 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS01.05 - DSS03.01 - DSS03.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - 3.1.20 - CCI-000366 - 4.2.3.4 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - CM-6(a) - SC-7(a) - DE.AE-1 - DE.CM-1 - ID.AM-3 - PR.AC-5 - PR.DS-4 - PR.DS-5 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - ICMP redirect messages are used by routers to inform hosts that a more -direct route exists for a particular destination. These messages contain information -from the system's route table possibly revealing portions of the network topology. - -The ability to send ICMP redirects is only appropriate for systems acting as routers. - - CCE-82485-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.ipv4.conf.default.send_redirects%3D0%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_send_redirects.conf - overwrite: true - - - - - - - - - - Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - To set the runtime status of the net.ipv4.ip_forward kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.ip_forward=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.ip_forward = 0 - Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking. -Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in -profiles or benchmarks that target usage of IPv4 forwarding. - BP28(R22) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 2 - 3 - 7 - 8 - 9 - APO13.01 - BAI04.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.03 - DSS03.05 - DSS05.02 - DSS05.05 - DSS05.07 - DSS06.06 - 3.1.20 - CCI-000366 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 6.2 - SR 7.1 - SR 7.2 - SR 7.6 - A.12.1.2 - A.12.1.3 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.17.2.1 - A.9.1.2 - CIP-007-3 R4 - CIP-007-3 R4.1 - CIP-007-3 R4.2 - CIP-007-3 R5.1 - CM-7(a) - CM-7(b) - SC-5 - CM-6(a) - SC-7(a) - DE.CM-1 - PR.DS-4 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000480-GPOS-00227 - Routing protocol daemons are typically used on routers to exchange -network topology information with other routers. If this capability is used when -not required, system network information may be unnecessarily transmitted across -the network. - - - - - - - - - - - - SuSEfirewall2 - The SuSEfirewall2 provides a managed firewall. - - - Uncomplicated Firewall (ufw) - The Linux kernel in Ubuntu provides a packet filtering system called -netfilter, and the traditional interface for manipulating netfilter are -the iptables suite of commands. iptables provide a complete firewall -solution that is both highly configurable and highly flexible. - -Becoming proficient in iptables takes time, and getting started with -netfilter firewalling using only iptables can be a daunting task. As a -result, many frontends for iptables have been created over the years, -each trying to achieve a different result and targeting a different -audience. - -The Uncomplicated Firewall (ufw) is a frontend for iptables and is -particularly well-suited for host-based firewalls. ufw provides a -framework for managing netfilter, as well as a command-line interface -for manipulating the firewall. ufw aims to provide an easy to use -interface for people unfamiliar with firewall concepts, while at the -same time simplifies complicated iptables commands to help an -administrator who knows what he or she is doing. ufw is an upstream -for other distributions and graphical frontends. - - - Verify ufw Enabled - -The ufw service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-ufw-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: ufw.service - enabled: true - - -This will enable the ufw service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - CCI-002314 - SRG-OS-000297-GPOS-00115 - The ufw service must be enabled and running in order for ufw to protect the system - - - - - - - - - - - Uncommon Network Protocols - The system includes support for several network protocols which are not commonly used. -Although security vulnerabilities in kernel networking code are not frequently discovered, -the consequences can be dramatic. Ensuring uncommon network protocols are disabled -reduces the system's risk to attacks targeted at its implementation of those protocols. - Although these protocols are not commonly used, avoid disruption -in your network environment by ensuring they are not needed -prior to disabling them. - - - Disable ATM Support - The Asynchronous Transfer Mode (ATM) is a protocol operating on -network, data link, and physical layers, based on virtual circuits -and virtual paths. - -To configure the system to prevent the atm -kernel module from being loaded, add the following line to the file /etc/modprobe.d/atm.conf: -install atm /bin/true - CCI-000381 - CCI-000366 - AC-18 - FMT_SMF_EXT.1 - SRG-OS-000095-GPOS-00049 - SRG-OS-000480-GPOS-00227 - Disabling ATM protects the system against exploitation of any -flaws in its implementation. - - CCE-82518-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20atm%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_atm_disabled.conf - overwrite: true - - - - - - - - - - Disable CAN Support - The Controller Area Network (CAN) is a serial communications -protocol which was initially developed for automotive and -is now also used in marine, industrial, and medical applications. - -To configure the system to prevent the can -kernel module from being loaded, add the following line to the file /etc/modprobe.d/can.conf: -install can /bin/true - CCI-000381 - CCI-000366 - AC-18 - FMT_SMF_EXT.1 - SRG-OS-000095-GPOS-00049 - SRG-OS-000480-GPOS-00227 - Disabling CAN protects the system against exploitation of any -flaws in its implementation. - - CCE-82519-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20can%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_can_disabled.conf - overwrite: true - - - - - - - - - - Disable IEEE 1394 (FireWire) Support - The IEEE 1394 (FireWire) is a serial bus standard for -high-speed real-time communication. - -To configure the system to prevent the firewire-core -kernel module from being loaded, add the following line to the file /etc/modprobe.d/firewire-core.conf: -install firewire-core /bin/true - CCI-000381 - AC-18 - FMT_SMF_EXT.1 - SRG-OS-000095-GPOS-00049 - Disabling FireWire protects the system against exploitation of any -flaws in its implementation. - - CCE-82517-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20firewire-core%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_firewire-core_disabled.conf - overwrite: true - - - - - - - - - - Disable RDS Support - The Reliable Datagram Sockets (RDS) protocol is a transport -layer protocol designed to provide reliable high-bandwidth, -low-latency communications between nodes in a cluster. - -To configure the system to prevent the rds -kernel module from being loaded, add the following line to the file /etc/modprobe.d/rds.conf: -install rds /bin/true - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Disabling RDS protects -the system against exploitation of any flaws in its implementation. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20rds%20/bin/true%0Ablacklist%20rds%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_rds_disabled.conf - overwrite: true - - - - - - - - - - Disable SCTP Support - The Stream Control Transmission Protocol (SCTP) is a -transport layer protocol, designed to support the idea of -message-oriented communication, with several streams of messages -within one connection. - -To configure the system to prevent the sctp -kernel module from being loaded, add the following line to the file /etc/modprobe.d/sctp.conf: -install sctp /bin/true - 11 - 14 - 3 - 9 - 5.10.1 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - CCI-000381 - CCI-000366 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - SRG-OS-000095-GPOS-00049 - SRG-OS-000480-GPOS-00227 - Disabling SCTP protects -the system against exploitation of any flaws in its implementation. - - CCE-82516-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20sctp%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_sctp_disabled.conf - overwrite: true - - - - - - - - - - Disable TIPC Support - The Transparent Inter-Process Communication (TIPC) protocol -is designed to provide communications between nodes in a -cluster. - -To configure the system to prevent the tipc -kernel module from being loaded, add the following line to the file /etc/modprobe.d/tipc.conf: -install tipc /bin/true - This configuration baseline was created to deploy the base operating system for general purpose -workloads. When the operating system is configured for certain purposes, such as -a node in High Performance Computing cluster, it is expected that -the tipc kernel module will be loaded. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - CCI-000381 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - FMT_SMF_EXT.1 - SRG-OS-000095-GPOS-00049 - Disabling TIPC protects -the system against exploitation of any flaws in its implementation. - - CCE-82520-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20tipc%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_tipc_disabled.conf - overwrite: true - - - - - - - - - - - Wireless Networking - Wireless networking, such as 802.11 -(WiFi) and Bluetooth, can present a security risk to sensitive or -classified systems and networks. Wireless networking hardware is -much more likely to be included in laptop or portable systems than -in desktops or servers. - -Removal of hardware provides the greatest assurance that the wireless -capability remains disabled. Acquisition policies often include provisions to -prevent the purchase of equipment that will be used in sensitive spaces and -includes wireless capabilities. If it is impractical to remove the wireless -hardware, and policy permits the device to enter sensitive spaces as long -as wireless is disabled, efforts should instead focus on disabling wireless capability -via software. - - Disable Wireless Through Software Configuration - If it is impossible to remove the wireless hardware -from the device in question, disable as much of it as possible -through software. The following methods can disable software -support for wireless networking, but note that these methods do not -prevent malicious software or careless users from re-activating the -devices. - - Disable Bluetooth Service - -The bluetooth service can be disabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-bluetooth-disable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: bluetooth.service - - -This will disable the bluetooth service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - -$ sudo service bluetooth stop - 11 - 12 - 14 - 15 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - 3.1.16 - CCI-000085 - CCI-001551 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - Disabling the bluetooth service prevents the system from attempting -connections to Bluetooth devices, which entails some security risk. -Nevertheless, variation in this risk decision may be expected due to the -utility of Bluetooth connectivity and its limited range. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: bluetooth.service - enabled: false - mask: true - - name: bluetooth.socket - enabled: false - mask: true - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: bluetooth.service - enabled: false - mask: true - - name: bluetooth.socket - enabled: false - mask: true - - - - - - - - - - Disable Bluetooth Kernel Module - The kernel's module loading system can be configured to prevent -loading of the Bluetooth module. Add the following to -the appropriate /etc/modprobe.d configuration file -to prevent the loading of the Bluetooth module: -install bluetooth /bin/true - 11 - 12 - 14 - 15 - 3 - 8 - 9 - 5.13.1.3 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - 3.1.16 - CCI-000085 - CCI-001443 - CCI-001444 - CCI-001551 - CCI-002418 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000095-GPOS-00049 - SRG-OS-000300-GPOS-00118 - If Bluetooth functionality must be disabled, preventing the kernel -from loading the kernel module provides an additional safeguard against its -activation. - - CCE-82515-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20bluetooth%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_bluetooth_disabled.conf - overwrite: true - - - - - - - - - - Disable Kernel cfg80211 Module - -To configure the system to prevent the cfg80211 -kernel module from being loaded, add the following line to the file /etc/modprobe.d/cfg80211.conf: -install cfg80211 /bin/true - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - AC-18(4) - If Wireless functionality must be disabled, preventing the kernel -from loading the kernel module provides an additional safeguard against its -activation. - - CCE-85932-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20cfg80211%20/bin/true%0Ablacklist%20cfg80211%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_cfg80211_disabled.conf - overwrite: true - - - - - - - - - - Disable Kernel iwlmvm Module - -To configure the system to prevent the iwlmvm -kernel module from being loaded, add the following line to the file /etc/modprobe.d/iwlmvm.conf: -install iwlmvm /bin/true - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - AC-18(4) - If Wireless functionality must be disabled, preventing the kernel -from loading the kernel module provides an additional safeguard against its -activation. - - CCE-85933-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20iwlmvm%20/bin/true%0Ablacklist%20iwlmvm%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_iwlmvm_disabled.conf - overwrite: true - - - - - - - - - - Disable Kernel iwlwifi Module - -To configure the system to prevent the iwlwifi -kernel module from being loaded, add the following line to the file /etc/modprobe.d/iwlwifi.conf: -install iwlwifi /bin/true - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - AC-18(4) - If Wireless functionality must be disabled, preventing the kernel -from loading the kernel module provides an additional safeguard against its -activation. - - CCE-85934-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20iwlwifi%20/bin/true%0Ablacklist%20iwlwifi%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_iwlwifi_disabled.conf - overwrite: true - - - - - - - - - - Disable Kernel mac80211 Module - -To configure the system to prevent the mac80211 -kernel module from being loaded, add the following line to the file /etc/modprobe.d/mac80211.conf: -install mac80211 /bin/true - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - AC-18(4) - If Wireless functionality must be disabled, preventing the kernel -from loading the kernel module provides an additional safeguard against its -activation. - - CCE-85935-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20mac80211%20/bin/true%0Ablacklist%20mac80211%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_mac80211_disabled.conf - overwrite: true - - - - - - - - - - Disable WiFi or Bluetooth in BIOS - Some machines that include built-in wireless support offer the -ability to disable the device through the BIOS. This is hardware-specific; -consult your hardware manual or explore the BIOS setup during -boot. - 11 - 12 - 14 - 15 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - CCI-000085 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - Disabling wireless support in the BIOS prevents easy -activation of the wireless interface, generally requiring administrators -to reboot the system first. - - CCE-82659-4 - - - Deactivate Wireless Network Interfaces - Deactivating wireless network interfaces should prevent normal usage of the wireless -capability. - - -Configure the system to disable all wireless network interfaces with the following command: -$ sudo nmcli radio all off - 11 - 12 - 14 - 15 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - 3.1.16 - CCI-000085 - CCI-002418 - CCI-002421 - CCI-001443 - CCI-001444 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - 1315 - 1319 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - AC-18(a) - AC-18(3) - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000299-GPOS-00117 - SRG-OS-000300-GPOS-00118 - SRG-OS-000424-GPOS-00188 - SRG-OS-000481-GPOS-000481 - The use of wireless networking can introduce many different attack vectors into -the organization's network. Common attack vectors such as malicious association -and ad hoc networks will allow an attacker to spoof a wireless access point -(AP), allowing validated systems to connect to the malicious AP and enabling the -attacker to monitor and record network traffic. These malicious APs can also -serve to create a man-in-the-middle attack or be used to create a denial of -service to valid network resources. - - CCE-82660-2 - - - - - - - - - - - Disable Unused Interfaces - Network interfaces expand the attack surface of the -system. Unused interfaces are not monitored or controlled, and -should be disabled. - -If the system does not require network communications but still -needs to use the loopback interface, remove all files of the form -ifcfg-interface except for ifcfg-lo from -/etc/sysconfig/network-scripts: -$ sudo rm /etc/sysconfig/network-scripts/ifcfg-interface -If the system is a standalone machine with no need for network access or even -communication over the loopback device, then disable this service. - -The network service can be disabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-network-disable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: network.service - - -This will disable the network service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - - - Transport Layer Security Support - Support for Transport Layer Security (TLS), and its predecessor, the Secure -Sockets Layer (SSL), is included in Red Hat Enterprise Linux in the OpenSSL software (RPM package -openssl). TLS provides encrypted and authenticated network -communications, and many network services include support for it. TLS or SSL -can be leveraged to avoid any plaintext transmission of sensitive data. - -For information on how to use OpenSSL, see -http://www.openssl.org/docs/. Information on FIPS validation -of OpenSSL is available at http://www.openssl.org/docs/fips.html -and http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm. - - - - File Permissions and Masks - Traditional Unix security relies heavily on file and -directory permissions to prevent unauthorized users from reading or -modifying files to which they should not have access. - -Several of the commands in this section search filesystems -for files or directories with certain characteristics, and are -intended to be run on every local partition on a given system. -When the variable PART appears in one of the commands below, -it means that the command is intended to be run repeatedly, with the -name of each local partition substituted for PART in turn. - -The following command prints a list of all xfs partitions on the local -system, which is the default filesystem for Red Hat Enterprise Linux CoreOS 4 -installations: -$ mount -t xfs | awk '{print $3}' -For any systems that use a different -local filesystem type, modify this command as appropriate. - - Verify Permissions on Important Files and -Directories - Permissions for many files on a system must be set -restrictively to ensure sensitive information is properly protected. -This section discusses important -permission restrictions which can be verified -to ensure that no harmful discrepancies have -arisen. - - Verify that All World-Writable Directories Have Sticky Bits Set - When the so-called 'sticky bit' is set on a directory, -only the owner of a given file may remove that file from the -directory. Without the sticky bit, any user with write access to a -directory may remove any file in the directory. Setting the sticky -bit prevents users from removing each other's files. In cases where -there is no reason for a directory to be world-writable, a better -solution is to remove that permission rather than to set the sticky -bit. However, if a directory is used by a particular application, -consult that application's documentation instead of blindly -changing modes. - -To set the sticky bit on a world-writable directory DIR, run the -following command: -$ sudo chmod +t DIR - BP28(R40) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-001090 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000138-GPOS-00069 - Failing to set the sticky bit on public directories allows unauthorized -users to delete files in the directory structure. - -The only authorized public directories are those temporary directories -supplied with the system, or those designed to be temporary file -repositories. The setting is normally reserved for directories used by the -system, by users for temporary file storage (such as /tmp), and -for directories requiring global read/write access. - CCE-82753-5 - - - - - - - - - Verify that local System.map file (if exists) is readable only by root - Files containing sensitive informations should be protected by restrictive - permissions. Most of the time, there is no need that these files need to be read by any non-root user - -To properly set the permissions of /boot/System.map-*, run the command: -$ sudo chmod 0600 /boot/System.map-* - BP28(R13) - The System.map file contains information about kernel symbols and - can give some hints to generate local exploitation. - - - - - - - - - Ensure No World-Writable Files Exist - It is generally a good idea to remove global (other) write -access to a file when it is discovered. However, check with -documentation for specific applications before making changes. -Also, monitor for recurring world-writable files, as these may be -symptoms of a misconfigured application or user account. Finally, -this applies to real files and not virtual files that are a part of -pseudo file systems such as sysfs or procfs. - BP28(R40) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Data in world-writable files can be modified by any -user on the system. In almost all circumstances, files can be -configured using a combination of user and group permissions to -support whatever legitimate access is needed without the risk -caused by world-writable files. - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Hardlinks - To set the runtime status of the fs.protected_hardlinks kernel parameter, run the following command: $ sudo sysctl -w fs.protected_hardlinks=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: fs.protected_hardlinks = 1 - BP28(R23) - CCI-002165 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - SRG-OS-000312-GPOS-00122 - SRG-OS-000312-GPOS-00123 - SRG-OS-000324-GPOS-00125 - By enabling this kernel parameter, users can no longer create soft or hard links to -files which they do not own. Disallowing such hardlinks mitigate vulnerabilities -based on insecure file system accessed by privileged programs, avoiding an -exploitation vector exploiting unsafe use of open() or creat(). - - CCE-82506-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,fs.protected_hardlinks%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_fs_protected_hardlinks.conf - overwrite: true - - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Symlinks - To set the runtime status of the fs.protected_symlinks kernel parameter, run the following command: $ sudo sysctl -w fs.protected_symlinks=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: fs.protected_symlinks = 1 - BP28(R23) - CCI-002165 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - SRG-OS-000312-GPOS-00122 - SRG-OS-000312-GPOS-00123 - SRG-OS-000324-GPOS-00125 - By enabling this kernel parameter, symbolic links are permitted to be followed -only when outside a sticky world-writable directory, or when the UID of the -link and follower match, or when the directory owner matches the symlink's owner. -Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system -accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of -open() or creat(). - - CCE-82507-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,fs.protected_symlinks%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_fs_protected_symlinks.conf - overwrite: true - - - - - - - - - - Verify Permissions on Files with Local Account Information and Credentials - The default restrictive permissions for files which act as -important security databases such as passwd, shadow, -group, and gshadow files must be maintained. Many utilities -need read access to the passwd file in order to function properly, but -read access to the shadow file allows malicious attacks against system -passwords, and should never be enabled. - - Verify Group Who Owns Backup group File - To properly set the group owner of /etc/group-, run the command: $ sudo chgrp root /etc/group- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/group- file is a backup file of /etc/group, and as such, -it contains information regarding groups that are configured on the system. -Protection of this file is important for system security. - - - - - - - - - Verify Group Who Owns Backup gshadow File - To properly set the group owner of /etc/gshadow-, run the command: $ sudo chgrp root /etc/gshadow- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/gshadow- file is a backup of /etc/gshadow, and as such, -it contains group password hashes. Protection of this file is critical for system security. - - - - - - - - - Verify Group Who Owns Backup passwd File - To properly set the group owner of /etc/passwd-, run the command: $ sudo chgrp root /etc/passwd- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/passwd- file is a backup file of /etc/passwd, and as such, -it contains information about the users that are configured on the system. -Protection of this file is critical for system security. - - - - - - - - - Verify User Who Owns Backup shadow File - To properly set the group owner of /etc/shadow-, run the command: $ sudo chgrp root /etc/shadow- - The /etc/shadow- file is a backup file of /etc/shadow, and as such, -it contains the list of local system accounts and password hashes. -Protection of this file is critical for system security. - - - - - - - - - Verify Group Who Owns group File - To properly set the group owner of /etc/group, run the command: $ sudo chgrp root /etc/group - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - The /etc/group file contains information regarding groups that are configured -on the system. Protection of this file is important for system security. - - - - - - - - - Verify Group Who Owns gshadow File - To properly set the group owner of /etc/gshadow, run the command: $ sudo chgrp root /etc/gshadow - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - The /etc/gshadow file contains group password hashes. Protection of this file -is critical for system security. - - - - - - - - - Verify Group Who Owns passwd File - To properly set the group owner of /etc/passwd, run the command: $ sudo chgrp root /etc/passwd - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - The /etc/passwd file contains information about the users that are configured on -the system. Protection of this file is critical for system security. - - - - - - - - - Verify Group Who Owns shadow File - To properly set the group owner of /etc/shadow, run the command: $ sudo chgrp root /etc/shadow - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - The /etc/shadow file stores password hashes. Protection of this file is -critical for system security. - - - - - - - - - Verify User Who Owns Backup group File - To properly set the owner of /etc/group-, run the command: $ sudo chown root /etc/group- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/group- file is a backup file of /etc/group, and as such, -it contains information regarding groups that are configured on the system. -Protection of this file is important for system security. - - - - - - - - - Verify User Who Owns Backup gshadow File - To properly set the owner of /etc/gshadow-, run the command: $ sudo chown root /etc/gshadow- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/gshadow- file is a backup of /etc/gshadow, and as such, -it contains group password hashes. Protection of this file is critical for system security. - - - - - - - - - Verify User Who Owns Backup passwd File - To properly set the owner of /etc/passwd-, run the command: $ sudo chown root /etc/passwd- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/passwd- file is a backup file of /etc/passwd, and as such, -it contains information about the users that are configured on the system. -Protection of this file is critical for system security. - - - - - - - - - Verify Group Who Owns Backup shadow File - To properly set the owner of /etc/shadow-, run the command: $ sudo chown root /etc/shadow- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/shadow- file is a backup file of /etc/shadow, and as such, -it contains the list of local system accounts and password hashes. -Protection of this file is critical for system security. - - - - - - - - - Verify User Who Owns group File - To properly set the owner of /etc/group, run the command: $ sudo chown root /etc/group - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - SRG-OS-000480-GPOS-00227 - The /etc/group file contains information regarding groups that are configured -on the system. Protection of this file is important for system security. - - - - - - - - - Verify User Who Owns gshadow File - To properly set the owner of /etc/gshadow, run the command: $ sudo chown root /etc/gshadow - BP28(R36) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - The /etc/gshadow file contains group password hashes. Protection of this file -is critical for system security. - - - - - - - - - Verify User Who Owns passwd File - To properly set the owner of /etc/passwd, run the command: $ sudo chown root /etc/passwd - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - SRG-OS-000480-GPOS-00227 - The /etc/passwd file contains information about the users that are configured on -the system. Protection of this file is critical for system security. - - - - - - - - - Verify User Who Owns shadow File - To properly set the owner of /etc/shadow, run the command: $ sudo chown root /etc/shadow - BP28(R36) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - SRG-OS-000480-GPOS-00227 - The /etc/shadow file contains the list of local -system accounts and stores password hashes. Protection of this file is -critical for system security. Failure to give ownership of this file -to root provides the designated owner with access to sensitive information -which could weaken the system security posture. - - - - - - - - - Verify Permissions on Backup group File - -To properly set the permissions of /etc/group-, run the command: -$ sudo chmod 0644 /etc/group- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/group- file is a backup file of /etc/group, and as such, -it contains information regarding groups that are configured on the system. -Protection of this file is important for system security. - - - - - - - - - Verify Permissions on Backup gshadow File - -To properly set the permissions of /etc/gshadow-, run the command: -$ sudo chmod 0000 /etc/gshadow- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/gshadow- file is a backup of /etc/gshadow, and as such, -it contains group password hashes. Protection of this file is critical for system security. - - - - - - - - - Verify Permissions on Backup passwd File - -To properly set the permissions of /etc/passwd-, run the command: -$ sudo chmod 0644 /etc/passwd- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/passwd- file is a backup file of /etc/passwd, and as such, -it contains information about the users that are configured on the system. -Protection of this file is critical for system security. - - - - - - - - - Verify Permissions on Backup shadow File - -To properly set the permissions of /etc/shadow-, run the command: -$ sudo chmod 0000 /etc/shadow- - CCI-002223 - AC-6 (1) - SRG-OS-000480-GPOS-00227 - The /etc/shadow- file is a backup file of /etc/shadow, and as such, -it contains the list of local system accounts and password hashes. -Protection of this file is critical for system security. - - - - - - - - - Verify Permissions on group File - -To properly set the permissions of /etc/passwd, run the command: -$ sudo chmod 0644 /etc/passwd - BP28(R36) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - SRG-OS-000480-GPOS-00227 - The /etc/group file contains information regarding groups that are configured -on the system. Protection of this file is important for system security. - - - - - - - - - Verify Permissions on gshadow File - -To properly set the permissions of /etc/gshadow, run the command: -$ sudo chmod 0000 /etc/gshadow - BP28(R36) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - The /etc/gshadow file contains group password hashes. Protection of this file -is critical for system security. - - - - - - - - - Verify Permissions on passwd File - -To properly set the permissions of /etc/passwd, run the command: -$ sudo chmod 0644 /etc/passwd - BP28(R36) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - SRG-OS-000480-GPOS-00227 - If the /etc/passwd file is writable by a group-owner or the -world the risk of its compromise is increased. The file contains the list of -accounts on the system and associated information, and protection of this file -is critical for system security. - - - - - - - - - Verify Permissions on shadow File - -To properly set the permissions of /etc/shadow, run the command: -$ sudo chmod 0000 /etc/shadow - BP28(R36) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.2.2 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-002223 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - Req-8.7.c - SRG-OS-000480-GPOS-00227 - The /etc/shadow file contains the list of local -system accounts and stores password hashes. Protection of this file is -critical for system security. Failure to give ownership of this file -to root provides the designated owner with access to sensitive information -which could weaken the system security posture. - - - - - - - - - - Verify Permissions on Files within /var/log Directory - The /var/log directory contains files with logs of error -messages in the system and should only be accessed by authorized -personnel. - - Verify Group Who Owns /var/log Directory - To properly set the group owner of /var/log, run the command: $ sudo chgrp root /var/log - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log directory contains files with logs of error -messages in the system and should only be accessed by authorized -personnel. - - - - - - - - - Verify Group Who Owns /var/log/messages File - To properly set the group owner of /var/log/messages, run the command: $ sudo chgrp root /var/log/messages - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log/messages file contains logs of error messages in -the system and should only be accessed by authorized personnel. - - - - - - - - - Verify Group Who Owns /var/log/syslog File - To properly set the group owner of /var/log/syslog, run the command: $ sudo chgrp adm /var/log/syslog - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log/syslog file contains logs of error messages in -the system and should only be accessed by authorized personnel. - - - - - - - - - Verify User Who Owns /var/log Directory - To properly set the owner of /var/log, run the command: $ sudo chown root /var/log - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log directory contains files with logs of error -messages in the system and should only be accessed by authorized -personnel. - - - - - - - - - Verify User Who Owns /var/log/messages File - To properly set the owner of /var/log/messages, run the command: $ sudo chown root /var/log/messages - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log/messages file contains logs of error messages in -the system and should only be accessed by authorized personnel. - - - - - - - - - Verify User Who Owns /var/log/syslog File - To properly set the owner of /var/log/syslog, run the command: $ sudo chown syslog /var/log/syslog - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log/syslog file contains logs of error messages in -the system and should only be accessed by authorized personnel. - - - - - - - - - Verify Permissions on /var/log Directory - -To properly set the permissions of /var/log, run the command: -$ sudo chmod 0755 /var/log - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log directory contains files with logs of error -messages in the system and should only be accessed by authorized -personnel. - - - - - - - - - Verify Permissions on /var/log/messages File - -To properly set the permissions of /var/log/messages, run the command: -$ sudo chmod 0640 /var/log/messages - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log/messages file contains logs of error messages in -the system and should only be accessed by authorized personnel. - - - - - - - - - Verify Permissions on /var/log/syslog File - -To properly set the permissions of /var/log/syslog, run the command: -$ sudo chmod 0640 /var/log/syslog - CCI-001314 - SRG-OS-000206-GPOS-00084 - The /var/log/syslog file contains logs of error messages in -the system and should only be accessed by authorized personnel. - - - - - - - - - - Verify File Permissions Within Some Important Directories - Some directories contain files whose confidentiality or integrity -is notably important and may also be susceptible to misconfiguration over time, particularly if -unpackaged software is installed. As such, -an argument exists to verify that files' permissions within these directories remain -configured correctly and restrictively. - - Verify that System Executable Have Root Ownership - /bin -/sbin -/usr/bin -/usr/sbin -/usr/local/bin -/usr/local/sbin -All these directories should be owned by the root user. -If any directory DIR in these directories is found -to be owned by a user other than root, correct its ownership with the -following command: -$ sudo chown root DIR - CCI-001495 - SRG-OS-000258-GPOS-00099 - System binaries are executed by privileged users as well as system services, -and restrictive permissions are necessary to ensure that their -execution of these programs cannot be co-opted. - - - - - - - - - Verify that Shared Library Directories Have Root Ownership - System-wide shared library files, which are linked to executables -during process load time or run time, are stored in the following directories -by default: -/lib -/lib64 -/usr/lib -/usr/lib64 - -Kernel modules, which can be added to the kernel during runtime, are also -stored in /lib/modules. All files in these directories should be -owned by the root user. If the directories, is found to be owned -by a user other than root correct its -ownership with the following command: -$ sudo chown root DIR - CCI-001499 - CM-5(6) - CM-5(6).1 - SRG-OS-000259-GPOS-00100 - Files from shared library directories are loaded into the address -space of processes (including privileged ones) or of the kernel itself at -runtime. Proper ownership of library directories is necessary to protect -the integrity of the system. - - - - - - - - - Verify that System Executable Directories Have Restrictive Permissions - System executables are stored in the following directories by default: -/bin -/sbin -/usr/bin -/usr/sbin -/usr/local/bin -/usr/local/sbin -These directories should not be group-writable or world-writable. -If any directory DIR in these directories is found to be -group-writable or world-writable, correct its permission with the -following command: -$ sudo chmod go-w DIR - CCI-001495 - SRG-OS-000258-GPOS-00099 - System binaries are executed by privileged users, as well as system services, -and restrictive permissions are necessary to ensure execution of these programs -cannot be co-opted. - - - - - - - - - Verify that Shared Library Directories Have Restrictive Permissions - System-wide shared library directories, which contain are linked to executables -during process load time or run time, are stored in the following directories -by default: -/lib -/lib64 -/usr/lib -/usr/lib64 - -Kernel modules, which can be added to the kernel during runtime, are -stored in /lib/modules. All sub-directories in these directories -should not be group-writable or world-writable. If any file in these -directories is found to be group-writable or world-writable, correct -its permission with the following command: -$ sudo chmod go-w DIR - CCI-001499 - CIP-003-8 R6 - CM-5 - CM-5(6) - CM-5(6).1 - SRG-OS-000259-GPOS-00100 - If the operating system were to allow any user to make changes to software libraries, -then those changes might be implemented without undergoing the appropriate testing -and approvals that are part of a robust change management process. - -This requirement applies to operating systems with software libraries that are accessible -and configurable, as in the case of interpreted languages. Software libraries also include -privileged programs which execute with escalated privileges. Only qualified and authorized -individuals must be allowed to obtain access to information system components for purposes -of initiating changes, including upgrades and modifications. - - - - - - - - - Verify that System Executables Have Root Ownership - System executables are stored in the following directories by default: -/bin -/sbin -/usr/bin -/usr/libexec -/usr/local/bin -/usr/local/sbin -/usr/sbin -All files in these directories should be owned by the root user. -If any file FILE in these directories is found -to be owned by a user other than root, correct its ownership with the -following command: -$ sudo chown root FILE - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-001499 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-5(6) - CM-5(6).1 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000259-GPOS-00100 - System binaries are executed by privileged users as well as system services, -and restrictive permissions are necessary to ensure that their -execution of these programs cannot be co-opted. - - - - - - - - - Verify that Shared Library Files Have Root Ownership - System-wide shared library files, which are linked to executables -during process load time or run time, are stored in the following directories -by default: -/lib -/lib64 -/usr/lib -/usr/lib64 - -Kernel modules, which can be added to the kernel during runtime, are also -stored in /lib/modules. All files in these directories should be -owned by the root user. If the directory, or any file in these -directories, is found to be owned by a user other than root correct its -ownership with the following command: -$ sudo chown root FILE - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-001499 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-5(6) - CM-5(6).1 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000259-GPOS-00100 - Files from shared library directories are loaded into the address -space of processes (including privileged ones) or of the kernel itself at -runtime. Proper ownership is necessary to protect the integrity of the system. - - - - - - - - - Verify that System Executables Have Restrictive Permissions - System executables are stored in the following directories by default: -/bin -/sbin -/usr/bin -/usr/libexec -/usr/local/bin -/usr/local/sbin -/usr/sbin -All files in these directories should not be group-writable or world-writable. -If any file FILE in these directories is found -to be group-writable or world-writable, correct its permission with the -following command: -$ sudo chmod go-w FILE - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-001499 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-5(6) - CM-5(6).1 - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000259-GPOS-00100 - System binaries are executed by privileged users, as well as system services, -and restrictive permissions are necessary to ensure execution of these programs -cannot be co-opted. - - - - - - - - - Verify that Shared Library Files Have Restrictive Permissions - System-wide shared library files, which are linked to executables -during process load time or run time, are stored in the following directories -by default: -/lib -/lib64 -/usr/lib -/usr/lib64 - -Kernel modules, which can be added to the kernel during runtime, are -stored in /lib/modules. All files in these directories -should not be group-writable or world-writable. If any file in these -directories is found to be group-writable or world-writable, correct -its permission with the following command: -$ sudo chmod go-w FILE - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - CCI-001499 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - CM-5(6) - CM-5(6).1 - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000259-GPOS-00100 - Files from shared library directories are loaded into the address -space of processes (including privileged ones) or of the kernel itself at -runtime. Restrictive permissions are necessary to protect the integrity of the system. - - - - - - - - - - - Restrict Dynamic Mounting and Unmounting of -Filesystems - Linux includes a number of facilities for the automated addition -and removal of filesystems on a running system. These facilities may be -necessary in many environments, but this capability also carries some risk -- whether direct -risk from allowing users to introduce arbitrary filesystems, -or risk that software flaws in the automated mount facility itself could -allow an attacker to compromise the system. - -This command can be used to list the types of filesystems that are -available to the currently executing kernel: -$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko' -If these filesystems are not required then they can be explicitly disabled -in a configuratio file in /etc/modprobe.d. - - Disable the Automounter - The autofs daemon mounts and unmounts filesystems, such as user -home directories shared via NFS, on demand. In addition, autofs can be used to handle -removable media, and the default configuration provides the cdrom device as /misc/cd. -However, this method of providing access to removable media is not common, so autofs -can almost always be disabled if NFS is not in use. Even if NFS is required, it may be -possible to configure filesystem mounts statically by editing /etc/fstab -rather than relying on the automounter. - - -The autofs service can be disabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-autofs-disable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: autofs.service - - -This will disable the autofs service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 1 - 12 - 15 - 16 - 5 - APO13.01 - DSS01.04 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.4.6 - CCI-000366 - CCI-000778 - CCI-001958 - 164.308(a)(3)(i) - 164.308(a)(3)(ii)(A) - 164.310(d)(1) - 164.310(d)(2) - 164.312(a)(1) - 164.312(a)(2)(iv) - 164.312(b) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.18.1.4 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - PR.AC-1 - PR.AC-3 - PR.AC-6 - PR.AC-7 - SRG-OS-000114-GPOS-00059 - SRG-OS-000378-GPOS-00163 - SRG-OS-000480-GPOS-00227 - Disabling the automounter permits the administrator to -statically control filesystem mounting through /etc/fstab. - -Additionally, automatically mounting filesystems permits easy introduction of -unknown devices, thereby facilitating malicious activity. - - CCE-82663-6 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: autofs.service - enabled: false - mask: true - - name: autofs.socket - enabled: false - mask: true - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: autofs.service - - - - - - - - - - Disable Booting from USB Devices in Boot Firmware - Configure the system boot firmware (historically called BIOS on PC -systems) to disallow booting from USB drives. - 12 - 16 - APO13.01 - DSS01.04 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - CCI-001250 - 4.3.3.2.2 - 4.3.3.5.2 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.4 - SR 1.5 - SR 1.9 - SR 2.1 - SR 2.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.2.1 - MP-7 - CM-7(b) - CM-6(a) - PR.AC-3 - PR.AC-6 - Booting a system from a USB device would allow an attacker to -circumvent any security measures provided by the operating system. Attackers -could mount partitions and modify the configuration of the OS. - - CCE-82662-8 - - - Disable Kernel Support for USB via Bootloader Configuration - All USB support can be disabled by adding the nousb -argument to the kernel's boot loader configuration. To do so, -Add the nousb kernel argument via a MachineConfig -object. - Disabling all kernel support for USB will cause problems for systems -with USB-based keyboards, mice, or printers. This configuration is -infeasible for systems which require USB devices, which is common. - 12 - 16 - APO13.01 - DSS01.04 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - CCI-001250 - 164.308(a)(3)(i) - 164.308(a)(3)(ii)(A) - 164.310(d)(1) - 164.310(d)(2) - 164.312(a)(1) - 164.312(a)(2)(iv) - 164.312(b) - 4.3.3.2.2 - 4.3.3.5.2 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.4 - SR 1.5 - SR 1.9 - SR 2.1 - SR 2.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.2.1 - MP-7 - CM-6(a) - PR.AC-3 - PR.AC-6 - Disabling the USB subsystem within the Linux kernel at system boot will -protect against potentially malicious USB devices, although it is only practical -in specialized systems. - CCE-83443-2 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - kernelArguments: - - nousb - - - - - - - Disable Kernel Support for USB via Bootloader Configuration - All USB support can be disabled by adding the nousb -argument to the kernel's boot loader configuration. To do so, -append "nousb" to the kernel line in /etc/default/grub as shown: -kernel /vmlinuz-VERSION ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb - Disabling all kernel support for USB will cause problems for systems -with USB-based keyboards, mice, or printers. This configuration is -infeasible for systems which require USB devices, which is common. - 12 - 16 - APO13.01 - DSS01.04 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - CCI-001250 - 164.308(a)(3)(i) - 164.308(a)(3)(ii)(A) - 164.310(d)(1) - 164.310(d)(2) - 164.312(a)(1) - 164.312(a)(2)(iv) - 164.312(b) - 4.3.3.2.2 - 4.3.3.5.2 - 4.3.3.6.6 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.13 - SR 1.2 - SR 1.4 - SR 1.5 - SR 1.9 - SR 2.1 - SR 2.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.2.1 - MP-7 - CM-6(a) - PR.AC-3 - PR.AC-6 - Disabling the USB subsystem within the Linux kernel at system boot will -protect against potentially malicious USB devices, although it is only practical -in specialized systems. - - CCE-82661-0 - - - - - - Disable Mounting of cramfs - -To configure the system to prevent the cramfs -kernel module from being loaded, add the following line to the file /etc/modprobe.d/cramfs.conf: -install cramfs /bin/true - -This effectively prevents usage of this uncommon filesystem. - -The cramfs filesystem type is a compressed read-only -Linux filesystem embedded in small footprint systems. A -cramfs image can be used without having to first -decompress the image. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - CCI-000381 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - SRG-OS-000095-GPOS-00049 - Removing support for unneeded filesystem types reduces the local attack surface -of the server. - - CCE-82514-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20cramfs%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_cramfs_disabled.conf - overwrite: true - - - - - - - - - - Disable Mounting of freevxfs - -To configure the system to prevent the freevxfs -kernel module from being loaded, add the following line to the file /etc/modprobe.d/freevxfs.conf: -install freevxfs /bin/true - -This effectively prevents usage of this uncommon filesystem. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Linux kernel modules which implement filesystems that are not needed by the -local system should be disabled. - - CCE-82713-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20freevxfs%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_freevxfs_disabled.conf - overwrite: true - - - - - - - Disable Mounting of hfs - -To configure the system to prevent the hfs -kernel module from being loaded, add the following line to the file /etc/modprobe.d/hfs.conf: -install hfs /bin/true - -This effectively prevents usage of this uncommon filesystem. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Linux kernel modules which implement filesystems that are not needed by the -local system should be disabled. - - CCE-82714-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20hfs%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_hfs_disabled.conf - overwrite: true - - - - - - - Disable Mounting of hfsplus - -To configure the system to prevent the hfsplus -kernel module from being loaded, add the following line to the file /etc/modprobe.d/hfsplus.conf: -install hfsplus /bin/true - -This effectively prevents usage of this uncommon filesystem. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Linux kernel modules which implement filesystems that are not needed by the -local system should be disabled. - - CCE-82715-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20hfsplus%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_hfsplus_disabled.conf - overwrite: true - - - - - - - Disable Mounting of jffs2 - -To configure the system to prevent the jffs2 -kernel module from being loaded, add the following line to the file /etc/modprobe.d/jffs2.conf: -install jffs2 /bin/true - -This effectively prevents usage of this uncommon filesystem. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Linux kernel modules which implement filesystems that are not needed by the -local system should be disabled. - - CCE-82716-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20jffs2%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_jffs2_disabled.conf - overwrite: true - - - - - - - Disable Mounting of squashfs - -To configure the system to prevent the squashfs -kernel module from being loaded, add the following line to the file /etc/modprobe.d/squashfs.conf: -install squashfs /bin/true - -This effectively prevents usage of this uncommon filesystem. - -The squashfs filesystem type is a compressed read-only Linux -filesystem embedded in small footprint systems (similar to -cramfs). A squashfs image can be used without having -to first decompress the image. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Removing support for unneeded filesystem types reduces the local attack -surface of the system. - - CCE-82717-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20squashfs%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_squashfs_disabled.conf - overwrite: true - - - - - - - Disable Mounting of udf - -To configure the system to prevent the udf -kernel module from being loaded, add the following line to the file /etc/modprobe.d/udf.conf: -install udf /bin/true - -This effectively prevents usage of this uncommon filesystem. - -The udf filesystem type is the universal disk format -used to implement the ISO/IEC 13346 and ECMA-167 specifications. -This is an open vendor filesystem type for data storage on a broad -range of media. This filesystem type is neccessary to support -writing DVDs and newer optical disc formats. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Removing support for unneeded filesystem types reduces the local -attack surface of the system. - - CCE-82718-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20udf%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_udf_disabled.conf - overwrite: true - - - - - - - Disable Modprobe Loading of USB Storage Driver - To prevent USB storage devices from being used, configure the kernel module loading system -to prevent automatic loading of the USB storage driver. - -To configure the system to prevent the usb-storage -kernel module from being loaded, add the following line to the file /etc/modprobe.d/usb-storage.conf: -install usb-storage /bin/true - -This will prevent the modprobe program from loading the usb-storage -module, but will not prevent an administrator (or another program) from using the -insmod program to load the module manually. - 1 - 12 - 15 - 16 - 5 - APO13.01 - DSS01.04 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.1.21 - CCI-000366 - CCI-000778 - CCI-001958 - 164.308(a)(3)(i) - 164.308(a)(3)(ii)(A) - 164.310(d)(1) - 164.310(d)(2) - 164.312(a)(1) - 164.312(a)(2)(iv) - 164.312(b) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.6 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.18.1.4 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CM-7(a) - CM-7(b) - CM-6(a) - MP-7 - PR.AC-1 - PR.AC-3 - PR.AC-6 - PR.AC-7 - SRG-OS-000114-GPOS-00059 - SRG-OS-000378-GPOS-00163 - SRG-OS-000480-GPOS-00227 - USB storage devices such as thumb drives can be used to introduce -malicious software. - - CCE-82719-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20usb-storage%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_usb-storage_disabled.conf - overwrite: true - - - - - - - - - - Disable Mounting of vFAT filesystems - -To configure the system to prevent the vfat -kernel module from being loaded, add the following line to the file /etc/modprobe.d/vfat.conf: -install vfat /bin/true - -This effectively prevents usage of this uncommon filesystem. - -The vFAT filesystem format is primarily used on older -windows systems and portable USB drives or flash modules. It comes -in three types FAT12, FAT16, and FAT32 -all of which are supported by the vfat kernel module. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 3.4.6 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Removing support for unneeded filesystems reduces the local attack -surface of the system. - - CCE-82720-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20vfat%20/bin/true%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_vfat_disabled.conf - overwrite: true - - - - - - - - Restrict Partition Mount Options - System partitions can be mounted with certain options -that limit what files on those partitions can do. These options -are set in the /etc/fstab configuration file, and can be -used to make certain types of malicious behavior more difficult. - - Value for hidepid option - The hidepid mount option is applicable to /proc and is used to control who can access -the information in /proc/[pid] directories. The option can have one of the following -values: -0: Everybody may access all /proc/[pid] directories. -1: Users may not access files and subdirectories inside any /proc/[pid] directories - but their own. The /proc/[pid] directories themselves remain visible. -2: Same as for mode 1, but in addition the /proc/[pid] directories belonging to other - users become invisible. - 0 - 1 - 2 - 2 - - - Removable Partition - This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions, -and mount_option_nodev_removable_partitions to ensure that the correct mount options are set on partitions mounted from -removable media such as CD-ROMs, USB keys, and floppy drives. This value should be modified to reflect any removable -partitions that are required on the local system. - /dev/cdrom - - - Add nodev Option to /boot - The nodev mount option can be used to prevent device files from -being created in /boot. -Legitimate character and block devices should exist only in -the /dev directory on the root partition or within chroot -jails built for system services. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/boot. - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - - - - - - - - - Add nosuid Option to /boot - The nosuid mount option can be used to prevent -execution of setuid programs in /boot. The SUID and SGID permissions -should not be required on the boot partition. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/boot. - BP28(R12) - CCI-000366 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - SRG-OS-000480-GPOS-00227 - The presence of SUID and SGID executables should be tightly controlled. Users -should not be able to execute SUID or SGID binaries from boot partitions. - - - - - - - - - - Add nodev Option to /dev/shm - The nodev mount option can be used to prevent creation of device -files in /dev/shm. Legitimate character and block devices should -not exist within temporary directories like /dev/shm. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/dev/shm. - 11 - 13 - 14 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS05.06 - DSS06.06 - CCI-001764 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - CCE-82867-3 - - - - - - - - - Add noexec Option to /dev/shm - The noexec mount option can be used to prevent binaries -from being executed out of /dev/shm. -It can be dangerous to allow the execution of binaries -from world-writable temporary storage directories such as /dev/shm. -Add the noexec option to the list of -Options in the systemd.mount unit that -controls mounting of -/dev/shm. - 11 - 13 - 14 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS05.06 - DSS06.06 - CCI-001764 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - Allowing users to execute binaries from world-writable directories -such as /dev/shm can expose the system to potential compromise. - - CCE-82868-1 - - - - - - - - - Add nosuid Option to /dev/shm - The nosuid mount option can be used to prevent execution -of setuid programs in /dev/shm. The SUID and SGID permissions should not -be required in these world-writable directories. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/dev/shm. - 11 - 13 - 14 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS05.06 - DSS06.06 - CCI-001764 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The presence of SUID and SGID executables should be tightly controlled. Users -should not be able to execute SUID or SGID binaries from temporary storage partitions. - - CCE-82741-0 - - - - - - - - - Add nodev Option to /home - The nodev mount option can be used to prevent device files from -being created in /home. -Legitimate character and block devices should exist only in -the /dev directory on the root partition or within chroot -jails built for system services. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/home. - BP28(R12) - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - CCE-82740-2 - - - - - - - - - Add nosuid Option to /home - The nosuid mount option can be used to prevent -execution of setuid programs in /home. The SUID and SGID permissions -should not be required in these user data directories. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/home. - BP28(R12) - 11 - 13 - 14 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS05.06 - DSS06.06 - CCI-000366 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - SRG-OS-000480-GPOS-00227 - The presence of SUID and SGID executables should be tightly controlled. Users -should not be able to execute SUID or SGID binaries from user home directory partitions. - - - - - - - - - - Add nodev Option to Non-Root Local Partitions - The nodev mount option prevents files from being interpreted as -character or block devices. Legitimate character and block devices should -exist only in the /dev directory on the root partition or within -chroot jails built for system services. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of - - any non-root local partitions. - BP28(R12) - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - CCI-000366 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - SRG-OS-000480-GPOS-00227 - The nodev mount option prevents files from being -interpreted as character or block devices. The only legitimate location -for device files is the /dev directory located on the root partition. -The only exception to this is chroot jails, for which it is not advised -to set nodev on these filesystems. - - - - - - - - - - Add nodev Option to Removable Media Partitions - The nodev mount option prevents files from being -interpreted as character or block devices. -Legitimate character and block devices should exist only in -the /dev directory on the root partition or within chroot -jails built for system services. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of - - any removable media partitions. - 11 - 12 - 13 - 14 - 16 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.06 - DSS05.07 - DSS06.03 - DSS06.06 - CCI-000366 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - A.9.2.1 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.AC-3 - PR.AC-6 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - The only legitimate location for device files is the /dev directory -located on the root partition. An exception to this is chroot jails, and it is -not advised to set nodev on partitions which contain their root -filesystems. - - CCE-82865-7 - - - - - - - - - - Add noexec Option to Removable Media Partitions - The noexec mount option prevents the direct execution of binaries -on the mounted filesystem. Preventing the direct execution of binaries from -removable media (such as a USB key) provides a defense against malicious -software that may be present on such untrusted media. -Add the noexec option to the list of -Options in the systemd.mount unit that -controls mounting of - - any removable media partitions. - 11 - 12 - 13 - 14 - 16 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.06 - DSS05.07 - DSS06.03 - DSS06.06 - CCI-000087 - CCI-000366 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - A.9.2.1 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.AC-3 - PR.AC-6 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - Allowing users to execute binaries from removable media such as USB keys exposes -the system to potential compromise. - - CCE-82747-7 - - - - - - - - - - Add nosuid Option to Removable Media Partitions - The nosuid mount option prevents set-user-identifier (SUID) -and set-group-identifier (SGID) permissions from taking effect. These permissions -allow users to execute binaries with the same permissions as the owner and group -of the file respectively. Users should not be allowed to introduce SUID and SGID -files into the system via partitions mounted from removeable media. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of - - any removable media partitions. - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 8 - 9 - APO01.06 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.06 - DSS05.07 - DSS06.02 - DSS06.03 - DSS06.06 - CCI-000366 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 5.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.11.2.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.AC-3 - PR.AC-4 - PR.AC-6 - PR.DS-5 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - The presence of SUID and SGID executables should be tightly controlled. Allowing -users to introduce SUID or SGID binaries from partitions mounted off of -removable media would allow them to introduce their own highly-privileged programs. - - CCE-82745-1 - - - - - - - - - - Add nodev Option to /tmp - The nodev mount option can be used to prevent device files from -being created in /tmp. Legitimate character and block devices -should not exist within temporary directories like /tmp. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/tmp. - BP28(R12) - 11 - 13 - 14 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS05.06 - DSS06.06 - CCI-001764 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - - - - - - - - - Add noexec Option to /tmp - The noexec mount option can be used to prevent binaries -from being executed out of /tmp. -Add the noexec option to the list of -Options in the systemd.mount unit that -controls mounting of -/tmp. - BP28(R12) - 11 - 13 - 14 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS05.06 - DSS06.06 - CCI-001764 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - Allowing users to execute binaries from world-writable directories -such as /tmp should never be necessary in normal operation and -can expose the system to potential compromise. - - - - - - - - - - Add nosuid Option to /tmp - The nosuid mount option can be used to prevent -execution of setuid programs in /tmp. The SUID and SGID permissions -should not be required in these world-writable directories. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/tmp. - BP28(R12) - 11 - 13 - 14 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS05.06 - DSS06.06 - CCI-001764 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.11.2.9 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.8.2.1 - A.8.2.2 - A.8.2.3 - A.8.3.1 - A.8.3.3 - A.9.1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The presence of SUID and SGID executables should be tightly controlled. Users -should not be able to execute SUID or SGID binaries from temporary storage partitions. - - - - - - - - - - Add nodev Option to /var/log/audit - The nodev mount option can be used to prevent device files from -being created in /var/log/audit. -Legitimate character and block devices should exist only in -the /dev directory on the root partition or within chroot -jails built for system services. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/log/audit. - CCI-001764 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - - - - - - - - - Add noexec Option to /var/log/audit - The noexec mount option can be used to prevent binaries -from being executed out of /var/log/audit. -Add the noexec option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/log/audit. - CCI-001764 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - Allowing users to execute binaries from directories containing audit log files -such as /var/log/audit should never be necessary in normal operation and -can expose the system to potential compromise. - - - - - - - - - - Add nosuid Option to /var/log/audit - The nosuid mount option can be used to prevent -execution of setuid programs in /var/log/audit. The SUID and SGID permissions -should not be required in directories containing audit log files. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/log/audit. - CCI-001764 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The presence of SUID and SGID executables should be tightly controlled. Users -should not be able to execute SUID or SGID binaries from partitions -designated for audit log files. - - - - - - - - - - Add nodev Option to /var/log - The nodev mount option can be used to prevent device files from -being created in /var/log. -Legitimate character and block devices should exist only in -the /dev directory on the root partition or within chroot -jails built for system services. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/log. - CCI-001764 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - - - - - - - - - Add noexec Option to /var/log - The noexec mount option can be used to prevent binaries -from being executed out of /var/log. -Add the noexec option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/log. - BP28(R12) - CCI-001764 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - Allowing users to execute binaries from directories containing log files -such as /var/log should never be necessary in normal operation and -can expose the system to potential compromise. - - - - - - - - - - Add nosuid Option to /var/log - The nosuid mount option can be used to prevent -execution of setuid programs in /var/log. The SUID and SGID permissions -should not be required in directories containing log files. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/log. - BP28(R12) - CCI-001764 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The presence of SUID and SGID executables should be tightly controlled. Users -should not be able to execute SUID or SGID binaries from partitions -designated for log files. - - - - - - - - - - Add nodev Option to /var - The nodev mount option can be used to prevent device files from -being created in /var. -Legitimate character and block devices should exist only in -the /dev directory on the root partition or within chroot -jails built for system services. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/var. - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-6 - AC-6(1) - MP-7 - PR.IP-1 - PR.PT-2 - PR.PT-3 - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - - - - - - - - - Add nosuid Option to /var - The nosuid mount option can be used to prevent -execution of setuid programs in /var. The SUID and SGID permissions -should not be required for this directory. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/var. - BP28(R12) - The presence of SUID and SGID executables should be tightly controlled. - - - - - - - - - - Add nodev Option to /var/tmp - The nodev mount option can be used to prevent device files from -being created in /var/tmp. Legitimate character and block devices -should not exist within temporary directories like /var/tmp. -Add the nodev option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/tmp. - BP28(R12) - CCI-001764 - SRG-OS-000368-GPOS-00154 - The only legitimate location for device files is the /dev directory -located on the root partition. The only exception to this is chroot jails. - - CCE-82735-2 - - - - - - - - - Add noexec Option to /var/tmp - The noexec mount option can be used to prevent binaries -from being executed out of /var/tmp. -Add the noexec option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/tmp. - BP28(R12) - CCI-001764 - SRG-OS-000368-GPOS-00154 - Allowing users to execute binaries from world-writable directories -such as /var/tmp should never be necessary in normal operation and -can expose the system to potential compromise. - - CCE-82866-5 - - - - - - - - - Add nosuid Option to /var/tmp - The nosuid mount option can be used to prevent -execution of setuid programs in /var/tmp. The SUID and SGID permissions -should not be required in these world-writable directories. -Add the nosuid option to the list of -Options in the systemd.mount unit that -controls mounting of -/var/tmp. - BP28(R12) - CCI-001764 - SRG-OS-000368-GPOS-00154 - The presence of SUID and SGID executables should be tightly controlled. Users -should not be able to execute SUID or SGID binaries from temporary storage partitions. - - CCE-82736-0 - - - - - - - - - - Verify Permissions on Important Files and -Directories Are Configured in /etc/permissions.local - Permissions for many files on a system must be set -restrictively to ensure sensitive information is properly protected. -This section discusses the /etc/permissions.local file, where -expected permissions can be configured to be checked and fixed through -usage of the chkstat command. - - - Restrict Programs from Dangerous Execution Patterns - The recommendations in this section are designed to -ensure that the system's features to protect against potentially -dangerous program execution are activated. -These protections are applied at the system initialization or -kernel level, and defend against certain types of badly-configured -or compromised programs. - - kernel.unprivileged_bpf_disabled - Prevent unprivileged processes from using the bpf() syscall. - 2 - 1 - 2 - - - Disable the uvcvideo module - If the device contains a camera it should be covered or disabled when not in use. - CCI-000381 - CM-7 (a) - CM-7 (5) (b) - SRG-OS-000095-GPOS-00049 - SRG-OS-000370-GPOS-00155 - Failing to disconnect from collaborative computing devices (i.e., cameras) can result in subsequent compromises of organizational information. -Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure participants actually carry out the disconnect activity without having to go through complex and tedious procedures. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,install%20uvcvideo%20/bin/true%0Ablacklist%20uvcvideo%0A - mode: 0644 - path: /etc/modprobe.d/75-kernel_module_uvcvideo_disabled.conf - overwrite: true - - - - - - - - - - Disable storing core dumps - To set the runtime status of the kernel.core_pattern kernel parameter, run the following command: $ sudo sysctl -w kernel.core_pattern=|/bin/false -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.core_pattern = |/bin/false - CCI-000366 - SC-7(10) - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - A core dump includes a memory image taken at the time the operating system -terminates an application. The memory image could contain sensitive data and is generally useful -only for developers trying to debug problems. - - - CCE-82527-3 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.core_pattern%20%3D%20%7C/bin/false%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_core_pattern.conf - overwrite: true - - - - - - - - - - Disable storing core dumps - The kernel.core_pattern option specifies the core dumpfile pattern -name. It can be set to an empty string ''. In this case, the kernel -behaves differently based on another related option. If -kernel.core_uses_pid is set to 1, then a file named as -.PID (where PID is process ID of the crashed process) is -created in the working directory. If kernel.core_uses_pid is set to -0, no coredump is saved. -To set the runtime status of the kernel.core_pattern kernel parameter, -run the following command: -$ sudo sysctl -w kernel.core_pattern='' - -To make sure that the setting is persistent, -add the following line to a file in the directory /etc/sysctl.d: -kernel.core_pattern = ''' - FMT_SMF_EXT.1 - A core dump includes a memory image taken at the time the operating system -terminates an application. The memory image could contain sensitive data and is generally useful -only for developers trying to debug problems. - - - - - - - - - - - - Configure file name of core dumps - To set the runtime status of the kernel.core_uses_pid kernel parameter, run the following command: $ sudo sysctl -w kernel.core_uses_pid=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.core_uses_pid = 0 - FMT_SMF_EXT.1 - The default coredump filename is core. By setting -core_uses_pid to 1, the coredump filename becomes -core.PID. If core_pattern does not include -%p (default does not) and core_uses_pid is set, then -.PID will be appended to the filename. -When combined with kernel.core_pattern = "" configuration, it -is ensured that no core dumps are generated and also no confusing error -messages are printed by a shell. - - - - - - - - - - Restrict Access to Kernel Message Buffer - To set the runtime status of the kernel.dmesg_restrict kernel parameter, run the following command: $ sudo sysctl -w kernel.dmesg_restrict=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.dmesg_restrict = 1 - BP28(R23) - 3.1.5 - CCI-001090 - CCI-001314 - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - SI-11(a) - SI-11(b) - SRG-OS-000132-GPOS-00067 - SRG-OS-000138-GPOS-00069 - Unprivileged access to the kernel syslog can expose sensitive kernel -address information. - - CCE-82499-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.dmesg_restrict%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_dmesg_restrict.conf - overwrite: true - - - - - - - - - - Disable Kernel Image Loading - To set the runtime status of the kernel.kexec_load_disabled kernel parameter, run the following command: $ sudo sysctl -w kernel.kexec_load_disabled=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.kexec_load_disabled = 1 - CCI-001749 - CM-6 - SRG-OS-000480-GPOS-00227 - SRG-OS-000366-GPOS-00153 - Disabling kexec_load allows greater control of the kernel memory. -It makes it impossible to load another kernel image after it has been disabled. - - - CCE-82500-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.kexec_load_disabled%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_kexec_load_disabled.conf - overwrite: true - - - - - - - - - - Kernel panic on oops - To set the runtime status of the kernel.panic_on_oops kernel parameter, run the following command: $ sudo sysctl -w kernel.panic_on_oops=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.panic_on_oops = 1 - The system may start to panic when it normally wouldn't. A non-catastrophic error that -would have allowed the system to continue operating will now result in a panic. - An attacker trying to exploit the kernel may trigger kernel OOPSes, -panicking the system will impede them from continuing. - - - - - - - - - - Disallow kernel profiling by unprivileged users - To set the runtime status of the kernel.perf_event_paranoid kernel parameter, run the following command: $ sudo sysctl -w kernel.perf_event_paranoid=2 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.perf_event_paranoid = 2 - BP28(R23) - CCI-001090 - AC-6 - FMT_SMF_EXT.1 - SRG-OS-000132-GPOS-00067 - SRG-OS-000138-GPOS-00069 - Kernel profiling can reveal sensitive information about kernel behaviour. - - CCE-82502-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.perf_event_paranoid%3D2%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_perf_event_paranoid.conf - overwrite: true - - - - - - - - - - Disable Access to Network bpf() Syscall From Unprivileged Processes - To set the runtime status of the kernel.unprivileged_bpf_disabled kernel parameter, run the following command: $ sudo sysctl -w kernel.unprivileged_bpf_disabled=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.unprivileged_bpf_disabled = 1 - CCI-000366 - AC-6 - SC-7(10) - FMT_SMF_EXT.1 - SRG-OS-000132-GPOS-00067 - SRG-OS-000480-GPOS-00227 - Loading and accessing the packet filters programs and maps using the bpf() -syscall has the potential of revealing sensitive information about the kernel state. - - CCE-82504-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.unprivileged_bpf_disabled%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_unprivileged_bpf_disabled.conf - overwrite: true - - - - - - - - - - Restrict usage of ptrace to descendant processes - To set the runtime status of the kernel.yama.ptrace_scope kernel parameter, run the following command: $ sudo sysctl -w kernel.yama.ptrace_scope=1 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.yama.ptrace_scope = 1 - BP28(R25) - CCI-000366 - SC-7(10) - SRG-OS-000132-GPOS-00067 - SRG-OS-000480-GPOS-00227 - Unrestricted usage of ptrace allows compromised binaries to run ptrace -on another processes of the user. Like this, the attacker can steal -sensitive information from the target processes (e.g. SSH sessions, web browser, ...) -without any additional assistance from the user (i.e. without resorting to phishing). - - - CCE-82501-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.yama.ptrace_scope%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_yama_ptrace_scope.conf - overwrite: true - - - - - - - - - - Harden the operation of the BPF just-in-time compiler - To set the runtime status of the net.core.bpf_jit_harden kernel parameter, run the following command: $ sudo sysctl -w net.core.bpf_jit_harden=2 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.core.bpf_jit_harden = 2 - CCI-000366 - CM-6 - SC-7(10) - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - When hardened, the extended Berkeley Packet Filter just-in-time compiler -will randomize any kernel addresses in the BPF programs and maps, -and will not expose the JIT addresses in /proc/kallsyms. - - CCE-82505-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,net.core.bpf_jit_harden%3D2%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_net_core_bpf_jit_harden.conf - overwrite: true - - - - - - - - - - Disable the use of user namespaces - To set the runtime status of the user.max_user_namespaces kernel parameter, -run the following command: -$ sudo sysctl -w user.max_user_namespaces=0 - -To make sure that the setting is persistent, -add the following line to a file in the directory /etc/sysctl.d: -user.max_user_namespaces = 0 -When containers are deployed on the machine, the value should be set -to large non-zero value. - This configuration baseline was created to deploy the base operating system for general purpose -workloads. When the operating system is configured for certain purposes, such as to host Linux Containers, -it is expected that user.max_user_namespaces will be enabled. - CCI-000366 - SC-39 - CM-6(a) - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or system objectives. -These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. -They increase the risk to the platform by providing additional attack vectors. -User namespaces are used primarily for Linux containers. The value 0 -disallows the use of user namespaces. - - CCE-82503-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,user.max_user_namespaces%20%3D%200%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_user_max_user_namespaces.conf - overwrite: true - - - - - - - - - - Disable Core Dumps - A core dump file is the memory image of an executable -program when it was terminated by the operating system due to -errant behavior. In most cases, only software developers -legitimately need to access these files. The core dump files may -also contain sensitive information, or unnecessarily occupy large -amounts of disk space. - -Once a hard limit is set in /etc/security/limits.conf, or -to a file within the /etc/security/limits.d/ directory, a -user cannot increase that limit within his or her own session. If access -to core dumps is required, consider restricting them to only -certain users or groups. See the limits.conf man page for more -information. - -The core dumps of setuid programs are further protected. The -sysctl variable fs.suid_dumpable controls whether -the kernel allows core dumps from these programs at all. The default -value of 0 is recommended. - - Disable acquiring, saving, and processing core dumps - The systemd-coredump.socket unit is a socket activation of -the systemd-coredump@.service which processes core dumps. -By masking the unit, core dump processing is disabled. - CCI-000366 - SC-7(10) - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - A core dump includes a memory image taken at the time the operating system -terminates an application. The memory image could contain sensitive data -and is generally useful only for developers trying to debug problems. - - CCE-82530-7 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: systemd-coredump.service - enabled: false - mask: true - - name: systemd-coredump.socket - enabled: false - mask: true - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: systemd-coredump.service - enabled: false - mask: true - - name: systemd-coredump.socket - enabled: false - mask: true - - - - - - - - - - Disable core dump backtraces - The ProcessSizeMax option in [Coredump] section -of /etc/systemd/coredump.conf -specifies the maximum size in bytes of a core which will be processed. -Core dumps exceeding this size may be stored, but the backtrace will not -be generated. - If the /etc/systemd/coredump.conf file -does not already contain the [Coredump] section, -the value will not be configured correctly. - CCI-000366 - CM-6 - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - A core dump includes a memory image taken at the time the operating system -terminates an application. The memory image could contain sensitive data -and is generally useful only for developers or system operators trying to -debug problems. - -Enabling core dumps on production systems is not recommended, -however there may be overriding operational requirements to enable advanced -debuging. Permitting temporary enablement of core dumps during such situations -should be reviewed through local needs and policy. - CCE-82529-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A - mode: 0644 - path: /etc/systemd/coredump.conf - overwrite: true - - - - - - - - - - Disable storing core dump - The Storage option in [Coredump] section -of /etc/systemd/coredump.conf -can be set to none to disable storing core dumps permanently. - If the /etc/systemd/coredump.conf file -does not already contain the [Coredump] section, -the value will not be configured correctly. - CCI-000366 - CM-6 - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - A core dump includes a memory image taken at the time the operating system -terminates an application. The memory image could contain sensitive data -and is generally useful only for developers or system operators trying to -debug problems. Enabling core dumps on production systems is not recommended, -however there may be overriding operational requirements to enable advanced -debuging. Permitting temporary enablement of core dumps during such situations -should be reviewed through local needs and policy. - CCE-82528-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A - mode: 0644 - path: /etc/systemd/coredump.conf - overwrite: true - - - - - - - - - - Disable Core Dumps for All Users - To disable core dumps for all users, add the following line to -/etc/security/limits.conf, or to a file within the -/etc/security/limits.d/ directory: -* hard core 0 - 1 - 12 - 13 - 15 - 16 - 2 - 7 - 8 - APO13.01 - BAI04.04 - DSS01.03 - DSS03.05 - DSS05.07 - CCI-000366 - SR 6.2 - SR 7.1 - SR 7.2 - A.12.1.3 - A.17.2.1 - CM-6 - SC-7(10) - DE.CM-1 - PR.DS-4 - SRG-OS-000480-GPOS-00227 - A core dump includes a memory image taken at the time the operating system -terminates an application. The memory image could contain sensitive data and is generally useful -only for developers trying to debug problems. - - CCE-82526-5 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%2A%20%20%20%20%20hard%20%20%20core%20%20%20%200 - mode: 0644 - path: /etc/security/limits.d/75-disable_users_coredumps.conf - overwrite: true - - - - - - - - - - Disable Core Dumps for SUID programs - To set the runtime status of the fs.suid_dumpable kernel parameter, run the following command: $ sudo sysctl -w fs.suid_dumpable=0 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: fs.suid_dumpable = 0 - BP28(R23) - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - SI-11(a) - SI-11(b) - The core dump of a setuid program is more likely to contain -sensitive data, as the program itself runs with greater privileges than the -user who initiated execution of the program. Disabling the ability for any -setuid program to write a core file decreases the risk of unauthorized access -of such data. - - - - - - - - - - - Daemon Umask - The umask is a per-process setting which limits -the default permissions for creation of new files and directories. -The system includes initialization scripts which set the default umask -for system daemons. - - daemon umask - Enter umask for daemons - 022 - 027 - 022 - - - - Enable ExecShield - ExecShield describes kernel features that provide -protection against exploitation of memory corruption errors such as buffer -overflows. These features include random placement of the stack and other -memory regions, prevention of execution in memory that should only hold data, -and special handling of text buffers. These protections are enabled by default -on 32-bit systems and controlled through sysctl variables -kernel.exec-shield and kernel.randomize_va_space. On the latest -64-bit systems, kernel.exec-shield cannot be enabled or disabled with -sysctl. - - kernel.kptr_restrict - Configure exposition of kernel pointer addresses - 1 - 1 - 2 - - - Restrict Exposed Kernel Pointer Addresses Access - To set the runtime status of the kernel.kptr_restrict kernel parameter, run the following command: $ sudo sysctl -w kernel.kptr_restrict= -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.kptr_restrict = - BP28(R23) - CCI-002824 - CCI-000366 - CIP-002-5 R1.1 - CIP-002-5 R1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 4.1 - CIP-004-6 4.2 - CIP-004-6 R2.2.3 - CIP-004-6 R2.2.4 - CIP-004-6 R2.3 - CIP-004-6 R4 - CIP-005-6 R1 - CIP-005-6 R1.1 - CIP-005-6 R1.2 - CIP-007-3 R3 - CIP-007-3 R3.1 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - CIP-007-3 R8.4 - CIP-009-6 R.1.1 - CIP-009-6 R4 - SC-30 - SC-30(2) - SC-30(5) - CM-6(a) - SRG-OS-000132-GPOS-00067 - SRG-OS-000433-GPOS-00192 - SRG-OS-000480-GPOS-00227 - Exposing kernel pointers (through procfs or seq_printf()) exposes kernel -writeable structures which may contain functions pointers. If a write vulnerability -occurs in the kernel, allowing write access to any of this structure, the kernel can -be compromised. This option disallow any program without the CAP_SYSLOG capability -to get the addresses of kernel pointers by replacing them with 0. - - CCE-82498-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.kptr_restrict%3D1%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_kptr_restrict.conf - overwrite: true - - - - - - - - - - - Enable Randomized Layout of Virtual Address Space - To set the runtime status of the kernel.randomize_va_space kernel parameter, run the following command: $ sudo sysctl -w kernel.randomize_va_space=2 -To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.randomize_va_space = 2 - BP28(R23) - 3.1.7 - CCI-000366 - CCI-002824 - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - CIP-002-5 R1.1 - CIP-002-5 R1.2 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 4.1 - CIP-004-6 4.2 - CIP-004-6 R2.2.3 - CIP-004-6 R2.2.4 - CIP-004-6 R2.3 - CIP-004-6 R4 - CIP-005-6 R1 - CIP-005-6 R1.1 - CIP-005-6 R1.2 - CIP-007-3 R3 - CIP-007-3 R3.1 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.1.3 - CIP-007-3 R5.2.1 - CIP-007-3 R5.2.3 - CIP-007-3 R8.4 - CIP-009-6 R.1.1 - CIP-009-6 R4 - SC-30 - SC-30(2) - CM-6(a) - SRG-OS-000433-GPOS-00193 - SRG-OS-000480-GPOS-00227 - Address space layout randomization (ASLR) makes it more difficult for an -attacker to predict the location of attack code they have introduced into a -process's address space during an attempt at exploitation. Additionally, -ASLR makes it more difficult for an attacker to know the location of -existing code in order to re-purpose it using return oriented programming -(ROP) techniques. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,kernel.randomize_va_space%3D2%0A - mode: 0644 - path: /etc/sysctl.d/75-sysctl_kernel_randomize_va_space.conf - overwrite: true - - - - - - - - - - - Enable Execute Disable (XD) or No Execute (NX) Support on -x86 Systems - Recent processors in the x86 family support the -ability to prevent code execution on a per memory page basis. -Generically and on AMD processors, this ability is called No -Execute (NX), while on Intel processors it is called Execute -Disable (XD). This ability can help prevent exploitation of buffer -overflow vulnerabilities and should be activated whenever possible. -Extra steps must be taken to ensure that this protection is -enabled, particularly on 32-bit x86 systems. Other processors, such -as Itanium and POWER, have included such support since inception -and the standard kernel for those platforms supports the -feature. This is enabled by default on the latest Red Hat and -Fedora systems if supported by the hardware. - - - Memory Poisoning - Memory Poisoning consists of writing a special value to uninitialized or freed memory. -Poisoning can be used as a mechanism to prevent leak of information and detection of -corrupted memory. - - - slub_debug - debug options - Defines the debug options to use in slub_debug kernel command line argument. - P - F - Z - P - FZ - FZP - - - Enable page allocator poisoning - To enable poisoning of free pages, add the argument page_poison=1 to all -BLS (Boot Loader Specification) entries ('options' line) for the Linux -operating system in /boot/loader/entries/*.conf. - CM-6(a) - SRG-OS-000480-GPOS-00227 - Poisoning writes an arbitrary value to freed pages, so any modification or -reference to that page after being freed or before being initialized will be -detected and prevented. -This prevents many types of use-after-free vulnerabilities at little performance cost. -Also prevents leak of data and detection of corrupted memory. - - CCE-82673-5 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - kernelArguments: - - page_poison=1 - - - - - - - - - - Enable SLUB/SLAB allocator poisoning - To enable poisoning of SLUB/SLAB objects, add the argument slub_debug=P to all -BLS (Boot Loader Specification) entries ('options' line) for the Linux -operating system in /boot/loader/entries/*.conf. - CM-6(a) - SRG-OS-000433-GPOS-00192 - Poisoning writes an arbitrary value to freed objects, so any modification or -reference to that object after being freed or before being initialized will be -detected and prevented. -This prevents many types of use-after-free vulnerabilities at little performance cost. -Also prevents leak of data and detection of corrupted memory. - - CCE-82672-7 - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - kernelArguments: - - slub_debug=P - - - - - - - - - - - - - SELinux - SELinux is a feature of the Linux kernel which can be -used to guard against misconfigured or compromised programs. -SELinux enforces the idea that programs should be limited in what -files they can access and what actions they can take. - -The default SELinux policy, as configured on Red Hat Enterprise Linux CoreOS 4, has been -sufficiently developed and debugged that it should be usable on -almost any system with minimal configuration and a small -amount of system administrator training. This policy prevents -system services - including most of the common network-visible -services such as mail servers, FTP servers, and DNS servers - from -accessing files which those services have no valid reason to -access. This action alone prevents a huge amount of possible damage -from network attacks against services, from trojaned software, and -so forth. - -This guide recommends that SELinux be enabled using the -default (targeted) policy on every Red Hat Enterprise Linux CoreOS 4 system, unless that -system has unusual requirements which make a stronger policy -appropriate. - - - SELinux policy - Type of policy in use. Possible values are: -targeted - Only targeted network daemons are protected. -strict - Full SELinux protection. -mls - Multiple levels of security - targeted - mls - targeted - - - SELinux state - enforcing - SELinux security policy is enforced. -permissive - SELinux prints warnings instead of enforcing. -disabled - SELinux is fully disabled. - enforcing - disabled - enforcing - permissive - - - Install libselinux Package - The libselinux package can be installed with the following command: - - Security-enhanced Linux is a feature of the Linux kernel and a number of utilities -with enhanced security functionality designed to add mandatory access controls to Linux. - -The libselinux package contains the core library of the Security-enhanced Linux system. - - - - - - - - - - Uninstall setroubleshoot-plugins Package - The SETroubleshoot plugins are used to analyze SELinux AVC data. The service provides information around configuration errors, -unauthorized intrusions, and other potential errors. -The setroubleshoot-plugins package can be removed with the following command: - - BP28(R68) - The SETroubleshoot service is an unnecessary daemon to -have running on a server. - - CCE-84091-8 - - - - - - - - - Uninstall setroubleshoot-server Package - The SETroubleshoot service notifies desktop users of SELinux -denials. The service provides information around configuration errors, -unauthorized intrusions, and other potential errors. -The setroubleshoot-server package can be removed with the following command: - - BP28(R68) - The SETroubleshoot service is an unnecessary daemon to have -running on a server. - - CCE-84093-4 - - - - - - - - - Ensure SELinux Not Disabled in the kernel arguments - SELinux can be disabled at boot time by disabling it via a kernel argument. -Remove any instances of selinux=0 from the kernel arguments in that -file to prevent SELinux from being disabled at boot. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 4 - 5 - 6 - 8 - 9 - APO01.06 - APO11.04 - APO13.01 - BAI03.05 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.03 - DSS06.06 - MEA02.01 - 3.1.2 - 3.7.2 - CCI-000022 - CCI-000032 - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - 4.2.3.4 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-3 - AC-3(3)(a) - DE.AE-1 - ID.AM-3 - PR.AC-4 - PR.AC-5 - PR.AC-6 - PR.DS-5 - PR.PT-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000445-VMM-001780 - Disabling a major host protection feature, such as SELinux, at boot time prevents -it from confining system services at boot time. Further, it increases -the chances that it will remain off during system operation. - - CCE-83899-5 - - - - - - - - - Ensure SELinux Not Disabled in /etc/default/grub - SELinux can be disabled at boot time by an argument in -/etc/default/grub. -Remove any instances of selinux=0 from the kernel arguments in that -file to prevent SELinux from being disabled at boot. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 4 - 5 - 6 - 8 - 9 - APO01.06 - APO11.04 - APO13.01 - BAI03.05 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.03 - DSS06.06 - MEA02.01 - 3.1.2 - 3.7.2 - CCI-000022 - CCI-000032 - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - 4.2.3.4 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-3 - AC-3(3)(a) - DE.AE-1 - ID.AM-3 - PR.AC-4 - PR.AC-5 - PR.AC-6 - PR.DS-5 - PR.PT-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000445-VMM-001780 - Disabling a major host protection feature, such as SELinux, at boot time prevents -it from confining system services at boot time. Further, it increases -the chances that it will remain off during system operation. - - CCE-82666-9 - - - - - - - - - Ensure No Daemons are Unconfined by SELinux - Daemons for which the SELinux policy does not contain rules will inherit the -context of the parent process. Because daemons are launched during -startup and descend from the init process, they inherit the unconfined_service_t context. - - -To check for unconfined daemons, run the following command: -$ sudo ps -eZ | grep "unconfined_service_t" -It should produce no output in a well-configured system. - Automatic remediation of this control is not available. Remediation -can be achieved by amending SELinux policy or stopping the unconfined -daemons as outlined above. - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 6 - 9 - APO01.06 - APO11.04 - BAI03.05 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.06 - MEA02.01 - 3.1.2 - 3.1.5 - 3.7.2 - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - 4.3.3.3.9 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 2.8 - SR 2.9 - SR 5.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.5.1 - A.12.6.2 - A.12.7.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - AC-3(3)(a) - AC-6 - PR.AC-4 - PR.DS-5 - PR.IP-1 - PR.PT-1 - PR.PT-3 - Daemons which run with the unconfined_service_t context may cause AVC denials, -or allow privileges that the daemon does not require. - - CCE-82688-3 - - - - - - - - - Configure SELinux Policy - The SELinux targeted policy is appropriate for -general-purpose desktops and servers, as well as systems in many other roles. -To configure the system to use this policy, add or correct the following line -in /etc/selinux/config: -SELINUXTYPE= -Other policies, such as mls, provide additional security labeling -and greater confinement but are not compatible with many general-purpose -use cases. - BP28(R66) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 4 - 5 - 6 - 8 - 9 - APO01.06 - APO11.04 - APO13.01 - BAI03.05 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.03 - DSS06.06 - MEA02.01 - 3.1.2 - 3.7.2 - CCI-002165 - CCI-002696 - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - 4.2.3.4 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.2 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-004-6 R3.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - CIP-007-3 R6.5 - AC-3 - AC-3(3)(a) - AU-9 - SC-7(21) - DE.AE-1 - ID.AM-3 - PR.AC-4 - PR.AC-5 - PR.AC-6 - PR.DS-5 - PR.PT-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000445-GPOS-00199 - SRG-OS-000445-VMM-001780 - Setting the SELinux policy to targeted or a more specialized policy -ensures the system will confine processes that are likely to be -targeted for exploitation, such as network or system services. - -Note: During the development or debugging of SELinux modules, it is common to -temporarily place non-production systems in permissive mode. In such -temporary cases, SELinux policies should be developed, and once work -is completed, the system should be reconfigured to -. - - CCE-82532-3 - - - - - - - - - - Ensure SELinux State is Enforcing - The SELinux state should be set to at -system boot time. In the file /etc/selinux/config, add or correct the -following line to configure the system to boot into enforcing mode: -SELINUX= - BP28(R4) - BP28(R66) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 4 - 5 - 6 - 8 - 9 - APO01.06 - APO11.04 - APO13.01 - BAI03.05 - DSS01.05 - DSS03.01 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.03 - DSS06.06 - MEA02.01 - 3.1.2 - 3.7.2 - CCI-001084 - CCI-002165 - CCI-002696 - 164.308(a)(1)(ii)(D) - 164.308(a)(3) - 164.308(a)(4) - 164.310(b) - 164.310(c) - 164.312(a) - 164.312(e) - 4.2.3.4 - 4.3.3.2.2 - 4.3.3.3.9 - 4.3.3.4 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - 4.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 2.8 - SR 2.9 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.1 - A.12.1.2 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - A.13.1.1 - A.13.1.2 - A.13.1.3 - A.13.2.1 - A.13.2.2 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.2 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-004-6 R3.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - CIP-007-3 R6.5 - AC-3 - AC-3(3)(a) - AU-9 - SC-7(21) - DE.AE-1 - ID.AM-3 - PR.AC-4 - PR.AC-5 - PR.AC-6 - PR.DS-5 - PR.PT-1 - PR.PT-3 - PR.PT-4 - SRG-OS-000445-GPOS-00199 - SRG-OS-000134-GPOS-00068 - SRG-OS-000445-VMM-001780 - Setting the SELinux state to enforcing ensures SELinux is able to confine -potentially compromised processes to the security policy, which is designed to -prevent them from causing damage to the system or further elevating their -privileges. - - CCE-82531-5 - - - - - - - - - - SELinux - Booleans - Enable or Disable runtime customization of SELinux system policies -without having to reload or recompile the SELinux policy. - - - abrt_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - abrt_handle_event SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - abrt_upload_watch_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - antivirus_can_scan_system SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - antivirus_use_jit SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - auditadm_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - authlogin_nsswitch_use_ldap SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - authlogin_radius SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - authlogin_yubikey SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - awstats_purge_apache_log_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - boinc_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - cdrecord_read_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cluster_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cluster_manage_all_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cluster_use_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cobbler_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cobbler_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cobbler_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cobbler_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - collectd_tcp_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - condor_tcp_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - conman_can_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - container_connect_any SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cron_can_relabel SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cron_system_cronjob_use_shares SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cron_userdomain_transition SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - cups_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - cvs_read_shadow SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - daemons_dump_core SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - daemons_enable_cluster_mode SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - daemons_use_tcp_wrapper SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - daemons_use_tty SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - dbadm_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - dbadm_manage_user_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - dbadm_read_user_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - deny_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - deny_ptrace SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - dhcpc_exec_iptables SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - dhcpd_use_ldap SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - domain_fd_use SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - domain_kernel_load_modules SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - entropyd_use_audio SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - exim_can_connect_db SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - exim_manage_user_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - exim_read_user_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - fcron_crond SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - fenced_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - fenced_can_ssh SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - fips_mode SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - ftpd_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ftpd_connect_all_unreserved SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ftpd_connect_db SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ftpd_full_access SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ftpd_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ftpd_use_fusefs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ftpd_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ftpd_use_passive_mode SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_cgi_enable_homedirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_cgi_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_cgi_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_session_bind_all_unreserved_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_session_users SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_system_enable_homedirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_system_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - git_system_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - gitosis_can_sendmail SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - glance_api_can_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - glance_use_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - glance_use_fusefs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - global_ssp SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - gluster_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - gluster_export_all_ro SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - gluster_export_all_rw SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - gpg_web_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - gssd_read_tmp SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - guest_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - haproxy_connect_any SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_builtin_scripting SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - httpd_can_check_spam SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_connect_ftp SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_connect_ldap SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_connect_mythtv SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_connect_zabbix SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_network_connect_cobbler SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_network_connect_db SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_network_memcache SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_network_relay SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_can_sendmail SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_dbus_avahi SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_dbus_sssd SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_dontaudit_search_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_enable_cgi SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - httpd_enable_ftp_server SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_enable_homedirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_graceful_shutdown SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - httpd_manage_ipa SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_mod_auth_ntlm_winbind SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_mod_auth_pam SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_read_user_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_run_ipa SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_run_preupgrade SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_run_stickshift SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_serve_cobbler_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_setrlimit SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_ssi_exec SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_sys_script_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_tmp_exec SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_tty_comm SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_unified SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_use_fusefs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_use_gpg SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_use_openstack SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_use_sasl SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - httpd_verify_dns SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - icecast_use_any_tcp_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - irc_use_any_tcp_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - irssi_use_full_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - kdumpgui_run_bootloader SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - kerberos_enabled SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - ksmtuned_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ksmtuned_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - logadm_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - logging_syslogd_can_sendmail SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - logging_syslogd_run_nagios_plugins SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - logging_syslogd_use_tty SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - login_console_enabled SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - logrotate_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - logwatch_can_network_connect_mail SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - lsmd_plugin_connect_any SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mailman_use_fusefs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mcelog_client SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mcelog_exec_scripts SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - mcelog_foreground SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mcelog_server SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - minidlna_read_generic_user_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mmap_low_allowed SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mock_enable_homedirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mount_anyfile SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - mozilla_plugin_bind_unreserved_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mozilla_plugin_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mozilla_plugin_use_bluejeans SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mozilla_plugin_use_gps SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mozilla_plugin_use_spice SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mozilla_read_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mpd_enable_homedirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mpd_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mpd_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mplayer_execstack SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - mysql_connect_any SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - nagios_run_pnp4nagios SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - nagios_run_sudo SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - named_tcp_bind_http_port SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - named_write_master_zones SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - neutron_can_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - nfs_export_all_ro SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - nfs_export_all_rw SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - nfsd_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - nis_enabled SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - nscd_use_shm SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - openshift_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - openvpn_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - openvpn_enable_homedirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - openvpn_run_unconfined SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - pcp_bind_all_unreserved_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - pcp_read_generic_logs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - piranha_lvs_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - polipo_connect_all_unreserved SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - polipo_session_bind_all_unreserved_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - polipo_session_users SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - polipo_use_cifs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - polipo_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - polyinstantiation_enabled SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - postfix_local_write_mail_spool SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - postgresql_can_rsync SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - postgresql_selinux_transmit_client_label SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - postgresql_selinux_unconfined_dbadm SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - postgresql_selinux_users_ddl SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - pppd_can_insmod SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - pppd_for_user SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - privoxy_connect_any SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - prosody_bind_http_port SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - puppetagent_manage_all_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - puppetmaster_use_db SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - racoon_read_shadow SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - rsync_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - rsync_client SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - rsync_export_all_ro SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - rsync_full_access SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_create_home_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_domain_controller SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_enable_home_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_export_all_ro SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_export_all_rw SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_load_libgfapi SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_portmapper SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_run_unconfined SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_share_fusefs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - samba_share_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - sanlock_use_fusefs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - sanlock_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - sanlock_use_samba SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - saslauthd_read_shadow SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - secadm_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - secure_mode SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - secure_mode_insmod SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - secure_mode_policyload SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_direct_dri_enabled SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - selinuxuser_execheap SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_execmod SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - selinuxuser_execstack SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_mysql_connect_enabled SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_ping SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - selinuxuser_postgresql_connect_enabled SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_rw_noexattrfile SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - selinuxuser_share_music SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_tcp_server SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_udp_server SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - selinuxuser_use_ssh_chroot SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - sge_domain_can_network_connect SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - sge_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - smartmon_3ware SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - smbd_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - spamassassin_can_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - spamd_enable_home_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - squid_connect_any SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - squid_use_tproxy SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ssh_chroot_rw_homedirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ssh_keysign SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - ssh_sysadm_login SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - staff_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - staff_use_svirt SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - swift_can_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - sysadm_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - telepathy_connect_all_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - telepathy_tcp_connect_generic_network_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - tftp_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - tftp_home_dir SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - tmpreaper_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - tmpreaper_use_samba SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - tor_bind_all_unreserved_ports SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - tor_can_network_relay SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - unconfined_chrome_sandbox_transition SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - unconfined_login SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - unconfined_mozilla_plugin_transition SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - unprivuser_use_svirt SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - use_ecryptfs_home_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - use_fusefs_home_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - use_lpd_server SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - use_nfs_home_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - use_samba_home_dirs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - user_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - varnishd_connect_any SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_read_qemu_ga_data SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_rw_qemu_ga_data SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_sandbox_use_all_caps SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - virt_sandbox_use_audit SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - virt_sandbox_use_mknod SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_sandbox_use_netlink SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_sandbox_use_sys_admin SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_transition_userdomain SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_comm SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_fusefs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_rawip SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_samba SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_sanlock SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - virt_use_usb SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - virt_use_xserver SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - webadm_manage_user_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - webadm_read_user_files SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - wine_mmap_zero_ignore SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xdm_bind_vnc_tcp_port SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xdm_exec_bootloader SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xdm_sysadm_login SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xdm_write_home SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xen_use_nfs SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xend_run_blktap SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - xend_run_qemu SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - xguest_connect_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - xguest_exec_content SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - xguest_mount_media SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - xguest_use_bluetooth SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - true - false - true - - - xserver_clients_write_xshm SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xserver_execmem SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - xserver_object_manager SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - zabbix_can_network SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - zarafa_setrlimit SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - zebra_write_config SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - zoneminder_anon_write SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - zoneminder_run_sudo SELinux Boolean - default - Default SELinux boolean setting. -on - SELinux boolean is enabled. -off - SELinux boolean is disabled. - false - false - true - - - - - - Services - The best protection against vulnerable software is running less software. This section describes how to review -the software which Red Hat Enterprise Linux CoreOS 4 installs on a system and disable software which is not needed. It -then enumerates the software packages installed on a default Red Hat Enterprise Linux CoreOS 4 system and provides guidance about which -ones can be safely disabled. - -Red Hat Enterprise Linux CoreOS 4 provides a convenient minimal install option that essentially installs the bare necessities for a functional -system. When building Red Hat Enterprise Linux CoreOS 4 systems, it is highly recommended to select the minimal packages and then build up -the system from there. - - Apport Service - The Apport service provides debugging and crash reporting -features on Ubuntu distributions. - - - APT service configuration - The apt service manage the package management and update of the whole system. Its configuration need to be properly defined to ensure efficient security updates, packages and repository authentication and proper lifecycle management. - - - Avahi Server - The Avahi daemon implements the DNS Service Discovery -and Multicast DNS protocols, which provide service and host -discovery on a network. It allows a system to automatically -identify resources on the network, such as printers or web servers. -This capability is also known as mDNSresponder and is a major part -of Zeroconf networking. - - Configure Avahi if Necessary - If your system requires the Avahi daemon, its configuration can be restricted -to improve security. The Avahi daemon configuration file is -/etc/avahi/avahi-daemon.conf. The following security recommendations -should be applied to this file: -See the avahi-daemon.conf(5) man page, or documentation at - - http://www.avahi.org, for more detailed information -about the configuration options. - - Disable Avahi Publishing - To prevent Avahi from publishing its records, edit /etc/avahi/avahi-daemon.conf -and ensure the following line appears in the [publish] section: -disable-publishing=yes - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - This helps ensure that no record will be published by Avahi. - - - - Disable Avahi Server if Possible - Because the Avahi daemon service keeps an open network -port, it is subject to network attacks. -Disabling it can reduce the system's vulnerability to such attacks. - - - - Base Services - This section addresses the base services that are installed on a -Red Hat Enterprise Linux CoreOS 4 default installation which are not covered in other -sections. Some of these services listen on the network and -should be treated with particular discretion. Other services are local -system utilities that may or may not be extraneous. In general, system services -should be disabled if not required. - - - Cron and At Daemons - The cron and at services are used to allow commands to -be executed at a later time. The cron service is required by almost -all systems to perform necessary maintenance tasks, while at may or -may not be required on a given system. Both daemons should be -configured defensively. - - - Install the cron service - The Cron service should be installed. - BP28(R50) - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-6(a) - PR.IP-1 - PR.PT-3 - The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only. - - - - - - - Enable cron Service - The crond service is used to execute commands at -preconfigured times. It is required by almost all systems to perform necessary -maintenance tasks, such as notifying root of system activity. - -The cron service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-cron-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: cron.service - enabled: true - - -This will enable the cron service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-6(a) - PR.IP-1 - PR.PT-3 - Due to its usage for maintenance and security-supporting tasks, -enabling the cron daemon is essential. - - - - - - - - - - Restrict at and cron to Authorized Users if Necessary - The /etc/cron.allow and /etc/at.allow files contain lists of -users who are allowed to use cron and at to delay execution of -processes. If these files exist and if the corresponding files -/etc/cron.deny and /etc/at.deny do not exist, then only users -listed in the relevant allow files can run the crontab and at commands -to submit jobs to be run at scheduled intervals. On many systems, only the -system administrator needs the ability to schedule jobs. Note that even if a -given user is not listed in cron.allow, cron jobs can still be run as -that user. The cron.allow file controls only administrative access -to the crontab command for scheduling and modifying cron jobs. - - -To restrict at and cron to only authorized users: -Remove the cron.deny file:$ sudo rm /etc/cron.denyEdit /etc/cron.allow, adding one line for each user allowed to use -the crontab command to create cron jobs.Remove the at.deny file:$ sudo rm /etc/at.denyEdit /etc/at.allow, adding one line for each user allowed to use -the at command to create at jobs. - - - - - Deprecated services - Some deprecated software services impact the overall system security due to their behavior (leak of -confidentiality in network exchange, usage as uncontrolled communication channel, risk associated with the service due to its old age, etc. - - Uninstall the inet-based telnet server - The inet-based telnet daemon should be uninstalled. - NT007(R03) - 11 - 12 - 14 - 15 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - telnet allows clear text communications, and does not protect any -data transmission between client and server. Any confidential data can be -listened and no integrity checking is made. - - - - - - Uninstall the nis package - The support for Yellowpages should not be installed unless it is required. - NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used. - - - - - - Uninstall the ntpdate package - ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled. - ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP. - - - - - - Uninstall the ssl compliant telnet server - The telnet daemon, even with ssl support, should be uninstalled. - NT007(R02) - 11 - 12 - 14 - 15 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - telnet, even with ssl support, should not be installed. -When remote shell is required, up-to-date ssh daemon can be used. - - - - - - Uninstall the telnet server - The telnet daemon should be uninstalled. - BP28(R1) - NT007(R03) - 11 - 12 - 14 - 15 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - telnet allows clear text communications, and does not protect -any data transmission between client and server. Any confidential data -can be listened and no integrity checking is made.' - - - - - - - DHCP - The Dynamic Host Configuration Protocol (DHCP) allows -systems to request and obtain an IP address and other configuration -parameters from a server. - -This guide recommends configuring networking on clients by manually editing -the appropriate files under /etc/sysconfig. Use of DHCP can make client -systems vulnerable to compromise by rogue DHCP servers, and should be avoided -unless necessary. If using DHCP is necessary, however, there are best practices -that should be followed to minimize security risk. - - Configure DHCP Client if Necessary - If DHCP must be used, then certain configuration changes can -minimize the amount of information it receives and applies from the network, -and thus the amount of incorrect information a rogue DHCP server could -successfully distribute. For more information on configuring dhclient, see the -dhclient(8) and dhclient.conf(5) man pages. - - Minimize the DHCP-Configured Options - Create the file /etc/dhcp/dhclient.conf, and add an -appropriate setting for each of the ten configuration settings which can be -obtained via DHCP. For each setting, do one of the following: - -If the setting should not be configured remotely by the DHCP server, -select an appropriate static value, and add the line: -supersede setting value; -If the setting should be configured remotely by the DHCP server, add the lines: -request setting; -require setting; -For example, suppose the DHCP server should provide only the IP address itself -and the subnet mask. Then the entire file should look like: -supersede domain-name "example.com"; -supersede domain-name-servers 192.168.1.2; -supersede nis-domain ""; -supersede nis-servers ""; -supersede ntp-servers "ntp.example.com "; -supersede routers 192.168.1.1; -supersede time-offset -18000; -request subnet-mask; -require subnet-mask; - In this example, the options nis-servers and -nis-domain are set to empty strings, on the assumption that the deprecated NIS -protocol is not in use. It is necessary to supersede settings for unused -services so that they cannot be set by a hostile DHCP server. If an option is -set to an empty string, dhclient will typically not attempt to configure the -service. - By default, the DHCP client program, dhclient, requests and applies -ten configuration options (in addition to the IP address) from the DHCP server. -subnet-mask, broadcast-address, time-offset, routers, domain-name, -domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers. Many -of the options requested and applied by dhclient may be the same for every -system on a network. It is recommended that almost all configuration options be -assigned statically, and only options which must vary on a host-by-host basis -be assigned via DHCP. This limits the damage which can be done by a rogue DHCP -server. If appropriate for your site, it is also possible to supersede the -host-name directive in /etc/dhcp/dhclient.conf, establishing a static -hostname for the system. However, dhclient does not use the host name option -provided by the DHCP server (instead using the value provided by a reverse DNS -lookup). - - - - Configure DHCP Server - If the system must act as a DHCP server, the configuration -information it serves should be minimized. Also, support for other protocols -and DNS-updating schemes should be explicitly disabled unless needed. The -configuration file for dhcpd is called /etc/dhcp/dhcpd.conf. The file -begins with a number of global configuration options. The remainder of the file -is divided into sections, one for each block of addresses offered by dhcpd, -each of which contains configuration options specific to that address -block. - - Minimize Served Information - Edit /etc/dhcp/dhcpd.conf. Examine each address range section within -the file, and ensure that the following options are not defined unless there is -an operational need to provide this information via DHCP: -option domain-name -option domain-name-servers -option nis-domain -option nis-servers -option ntp-servers -option routers -option time-offset - By default, the Red Hat Enterprise Linux client installation uses DHCP -to request much of the above information from the DHCP server. In particular, -domain-name, domain-name-servers, and routers are configured via DHCP. These -settings are typically necessary for proper network functionality, but are also -usually static across systems at a given site. - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - Because the configuration information provided by the DHCP server -could be maliciously provided to clients by a rogue DHCP server, the amount of -information provided via DHCP should be minimized. Remove these definitions -from the DHCP server configuration to ensure that legitimate clients do not -unnecessarily rely on DHCP for this information. - - - - Disable DHCP Client - DHCP is the default network configuration method provided by the system -installer, and common on many networks. Nevertheless, manual management -of IP addresses for systems implies a greater degree of management and -accountability for network activity. - - - Disable DHCP Server - The DHCP server dhcpd is not installed or activated by -default. If the software was installed and activated, but the -system does not need to act as a DHCP server, it should be disabled -and removed. - - - - DNS Server - Most organizations have an operational need to run at -least one nameserver. However, there are many common attacks -involving DNS server software, and this server software should -be disabled on any system -on which it is not needed. - - Disable DNS Server - DNS software should be disabled on any systems which does not -need to be a nameserver. Note that the BIND DNS server software is -not installed on Red Hat Enterprise Linux CoreOS 4 by default. The remainder of this section -discusses secure configuration of systems which must be -nameservers. - - Uninstall bind Package - The named service is provided by the bind package. -The bind package can be removed with the following command: - - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - CCI-000366 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - If there is no need to make DNS server software available, -removing it provides a safeguard against its activation. - - - - - - - - - - Isolate DNS from Other Services - This section discusses mechanisms for preventing the DNS server -from interfering with other services. This is done both to protect the -remainder of the network should a nameserver be compromised, and to make direct -attacks on nameservers more difficult. - - Run DNS Software in a chroot Jail - Install the bind-chroot package: -$ sudo yum install bind-chroot -Place a valid named.conf file inside the chroot jail: -$ sudo cp /etc/named.conf /var/named/chroot/etc/named.conf -$ sudo chown root:root /var/named/chroot/etc/named.conf -$ sudo chmod 644 /var/named/chroot/etc/named.conf -Create and populate an appropriate zone directory within the jail, based on the -options directive. If your named.conf includes: -options { -directory "/path/to/DIRNAME "; -... -} -then copy that directory and its contents from the original zone directory: -$ sudo cp -r /path/to/DIRNAME /var/named/chroot/DIRNAME -Add or correct the following line within /etc/sysconfig/named: -ROOTDIR=/var/named/chroot - If you are running BIND in a chroot jail, then you -should use the jailed named.conf as the primary nameserver -configuration file. That is, when this guide recommends editing -/etc/named.conf, you should instead edit -/var/named/chroot/etc/named.conf. - - - Run DNS Software on Dedicated Servers - Since DNS is -a high-risk service which must frequently be made available to the entire -Internet, it is strongly recommended that no other services be offered by -systems which act as organizational DNS servers. - - - - Protect DNS Data from Tampering or Attack - This section discusses DNS configuration options which make it -more difficult for attackers to gain access to private DNS data or to modify -DNS data. - - Use Views to Partition External and Internal Information - If it is not possible to run external and internal nameservers on -separate physical systems, run BIND9 and simulate this feature using views. -Edit /etc/named.conf. Add or correct the following directives (where -SUBNET is the numerical IP representation of your organization in the form -xxx.xxx.xxx.xxx/xx): -acl internal { - SUBNET ; - localhost; -}; -view "internal-view" { - match-clients { internal; }; - zone "." IN { - type hint; - file "db.cache"; - }; - zone "internal.example.com " IN { - ... - }; -}; - -view "external-view" { - match-clients { any; }; - recursion no; - zone "example.com " IN { - ... - }; -}; - As shown in the example, database files which are -required for recursion, such as the root hints file, must be available to any -clients which are allowed to make recursive queries. Under typical -circumstances, this includes only the internal clients which are allowed to use -this server as a general-purpose nameserver. - - - Run Separate DNS Servers for External and Internal Queries - Is it possible to run external and internal nameservers on -separate systems? If so, follow the configuration guidance in this section. On -the external nameserver, edit /etc/named.conf to add or correct the -following directives: -options { - allow-query { any; }; - recursion no; - ... -}; -zone "example.com " IN { - ... -}; -On the internal nameserver, edit /etc/named.conf. Add or correct the -following directives, where SUBNET is the numerical IP representation of your -organization in the form xxx.xxx.xxx.xxx/xx: -acl internal { - SUBNET ; - localhost; -}; -options { - allow-query { internal; }; - ... -}; -zone "internal.example.com " IN { - ... -}; - - - - - Docker Service - The docker service is necessary to create containers, which are - self-sufficient and self-contained applications using the resource - isolation features of the kernel. - - - Application Whitelisting Daemon - Fapolicyd (File Access Policy Daemon) implements application whitelisting -to decide file access rights. Applications that are known via a reputation -source are allowed access while unknown applications are not. The daemon -makes use of the kernel's fanotify interface to determine file access rights. - - - Install fapolicyd Package - The fapolicyd package can be installed with the following command: - - CCI-001764 - CCI-001774 - CM-6(a) - SI-4(22) - SRG-OS-000370-GPOS-00155 - SRG-OS-000368-GPOS-00154 - SRG-OS-000480-GPOS-00230 - fapolicyd (File Access Policy Daemon) -implements application whitelisting to decide file access rights. - - CCE-82533-1 - - - - - - - - - Enable the File Access Policy Service - The File Access Policy service should be enabled. - -The fapolicyd service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-fapolicyd-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: fapolicyd.service - enabled: true - - -This will enable the fapolicyd service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - CCI-001764 - CCI-001774 - CM-6(a) - SI-4(22) - FMT_SMF_EXT.1 - SRG-OS-000370-GPOS-00155 - SRG-OS-000368-GPOS-00154 - SRG-OS-000480-GPOS-00230 - The fapolicyd service (File Access Policy Daemon) -implements application whitelisting to decide file access rights. - - CCE-82534-9 - - - - - - - - - fapolicyd Must be Configured to Limit Access to Users Home Folders - fapolicyd needs be configured so that users cannot give access to their home folders to other users. - CCI-000366 - CM-6 b - SRG-OS-000480-GPOS-00230 - Users' home directories/folders may contain information of a sensitive nature. -Non-privileged users should coordinate any sharing of information with a System Administrator (SA) through shared resources. -fapolicyd can confine users to their home directory, not allowing them to make any changes outside of their own home directories. -Confining users to their home directory will minimize the risk of sharing information. - - - - - - - - FTP Server - FTP is a common method for allowing remote access to -files. Like telnet, the FTP protocol is unencrypted, which means -that passwords and other data transmitted during the session can be -captured and that the session is vulnerable to hijacking. -Therefore, running the FTP server software is not recommended. - -However, there are some FTP server configurations which may -be appropriate for some environments, particularly those which -allow only read-only anonymous access as a means of downloading -data available to the public. - - Disable vsftpd if Possible - To minimize attack surface, disable vsftpd if at all -possible. - - - Configure vsftpd to Provide FTP Service if Necessary - The primary vsftpd configuration file is -/etc/vsftpd.conf, if that file exists, or -/etc/vsftpd/vsftpd.conf if it does not. - - Configure Firewalls to Protect the FTP Server - -By default, iptables -blocks access to the ports used by the web server. - -To configure iptables to allow port 21 traffic, one must edit -/etc/sysconfig/iptables and -/etc/sysconfig/ip6tables (if IPv6 is in use). -Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain: --A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT -Edit the file /etc/sysconfig/iptables-config. Ensure that the space-separated list of modules contains -the FTP connection tracking module: -IPTABLES_MODULES="ip_conntrack_ftp" - These settings configure the firewall to allow connections to an FTP server. - - -The first line allows initial connections to the FTP server port. -FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client -and server negotiate an arbitrary port to be used for data transfer. The ip_conntrack_ftp module is used by -iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an -FTP server to operate on a system which is running a firewall. - - - Restrict the Set of Users Allowed to Access FTP - This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to -do this entirely due to legacy applications, how to restrict insecure FTP login to only those users who have an -identified need for this access. - - Limit Users Allowed FTP Access if Necessary - If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options: -userlist_enable=YES -userlist_file=/etc/vsftp.ftpusers -userlist_deny=NO -Edit the file /etc/vsftp.ftpusers. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name: -USERNAME -If anonymous access is also required, add the anonymous usernames to /etc/vsftp.ftpusers as well. -anonymous -ftp - Historically, the file /etc/ftpusers contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option userlist deny=NO is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified. - - - - - Use vsftpd to Provide FTP Service if Necessary - If your use-case requires FTP service, install and -set-up vsftpd to provide it. - - - - Web Server - The web server is responsible for providing access to -content via the HTTP protocol. Web servers represent a significant -security risk because: - -The HTTP port is commonly probed by malicious sourcesWeb server software is very complex, and includes a long -history of vulnerabilitiesThe HTTP protocol is unencrypted and vulnerable to passive -monitoring - -The system's default web server software is Apache 2 and is -provided in the RPM package httpd. - - Disable Apache if Possible - If Apache was installed and activated, but the system -does not need to act as a web server, then it should be disabled -and removed from the system. - - - Install Apache if Necessary - If httpd was not installed and activated, but the system -needs to act as a web server, then it should be installed on the system. Follow these -guidelines to install it defensively. The httpd package can be installed with -the following command: -$ sudo yum install httpd -This method of installation is recommended over installing the "Web Server" -package group during the system installation process. The Web Server package -group includes many packages which are likely extraneous, while the -command-line method installs only the required httpd package itself. - - Confirm Minimal Built-in Modules Installed - The default httpd installation minimizes the number of -modules that are compiled directly into the binary (core prefork http_core -mod_so). This minimizes risk by limiting the capabilities allowed by the -web server. - -Query the set of compiled-in modules using the following command: -$ httpd -l -If the number of compiled-in modules is significantly larger than the -aforementioned set, this guide recommends re-installing httpd with a -reduced configuration. Minimizing the number of modules that are compiled into -the httpd binary, reduces risk by limiting the capabilities allowed by -the webserver. - - - - Secure Apache Configuration - The httpd configuration file is -/etc/httpd/conf/httpd.conf. Apply the recommendations in the remainder -of this section to this file. - - HTTPD Log Level - The setting for LogLevel in /etc/httpd/conf/httpd.conf - alert - crit - warn - emerg - error - warn - - - Maximum KeepAlive Requests for HTTPD - The setting for MaxKeepAliveRequests in httpd.conf - 100 - 1000 - 10000 - 100000 - 500 - 100 - - - Configure Operating System to Protect Web Server - The following configuration steps should be taken on the system which hosts the -web server, in order to provide as safe an environment as possible for the web server. - - Run httpd in a chroot Jail if Practical - Running httpd inside a chroot jail is designed to isolate the -web server process to a small section of the filesystem, limiting the damage if -it is compromised. Versions of Apache greater than 2.2.10 (such as the one -included with Red Hat Enterprise Linux CoreOS 4) provide the ChrootDir directive. To run Apache -inside a chroot jail in /chroot/apache, add the following line to -/etc/httpd/conf/httpd.conf: ChrootDir /chroot/apache This -necessitates placing all files required by httpd inside -/chroot/apache , including httpd's binaries, modules, -configuration files, and served web pages. The details of this configuration -are beyond the scope of this guide. This may also require additional SELinux -configuration. - - - Restrict File and Directory Access - Minimize access to critical httpd files and directories. - - - - Configure PERL Securely - PERL (Practical Extraction and Report Language) is an interpreted language -optimized for scanning arbitrary text files, extracting information from those -text files, and printing reports based on that information. The language is -often used in shell scripting and is intended to be practical, easy to use, and -efficient means of generating interactive web pages for the user. - - - Configure PHP Securely - PHP is a widely-used and often misconfigured server-side scripting language. It should -be used with caution, but configured appropriately when needed. - -Review /etc/php.ini and make the following changes if possible: -# Do not expose PHP error messages to external users -display_errors = Off - -# Enable safe mode -safe_mode = On - -# Only allow access to executables in isolated directory -safe_mode_exec_dir = php-required-executables-path - -# Limit external access to PHP environment -safe_mode_allowed_env_vars = PHP_ - -# Restrict PHP information leakage -expose_php = Off - -# Log all errors -log_errors = On - -# Do not register globals for input data -register_globals = Off - -# Minimize allowable PHP post size -post_max_size = 1K - -# Ensure PHP redirects appropriately -cgi.force_redirect = 0 - -# Disallow uploading unless necessary -file_uploads = Off - -# Disallow treatment of file requests as fopen calls -allow_url_fopen = Off - -# Enable SQL safe mode -sql.safe_mode = On - - - - Directory Restrictions - The Directory tags in the web server configuration file allow finer grained access -control for a specified directory. All web directories should be configured on a -case-by-case basis, allowing access only where needed. - - - Minimize Web Server Loadable Modules - A default installation of httpd includes a plethora of dynamically shared objects (DSO) -that are loaded at run-time. Unlike the aforementioned compiled-in modules, a DSO can be -disabled in the configuration file by removing the corresponding LoadModule directive. - -Note: A DSO only provides additional functionality if associated directives are included -in the httpd configuration file. It should also be noted that removing a DSO will produce -errors on httpd startup if the configuration file contains directives that apply to that -module. Refer to http://httpd.apache.org/docs/ for details on which directives -are associated with each DSO. - -Following each DSO removal, the configuration can be tested with the following command -to check if everything still works: -$ sudo service httpd configtest -The purpose of each of the modules loaded by default will now be addressed one at a time. -If none of a module's directives are being used, remove it. - - httpd Core Modules - These modules comprise a basic subset of modules that are likely needed for base httpd -functionality; ensure they are not commented out in /etc/httpd/conf/httpd.conf: -LoadModule auth_basic_module modules/mod_auth_basic.so -LoadModule authn_default_module modules/mod_authn_default.so -LoadModule authz_host_module modules/mod_authz_host.so -LoadModule authz_user_module modules/mod_authz_user.so -LoadModule authz_groupfile_module modules/mod_authz_groupfile.so -LoadModule authz_default_module modules/mod_authz_default.so -LoadModule log_config_module modules/mod_log_config.so -LoadModule logio_module modules/mod_logio.so -LoadModule setenvif_module modules/mod_setenvif.so -LoadModule mime_module modules/mod_mome.so -LoadModule autoindex_module modules/mod_autoindex.so -LoadModule negotiation_module modules/mod_negotiation.so -LoadModule dir_module modules/mod_dir.so -LoadModule alias_module modules/mod_alias.so -Minimizing the number of loadable modules available to the web server reduces risk -by limiting the capabilities allowed by the web server. - - Minimize Modules for HTTP Basic Authentication - The following modules are necessary if this web server will provide content that will -be restricted by a password. - -Authentication can be performed using local plain text password files (authn_file), -local DBM password files (authn_dbm) or an LDAP directory. The only module required by -the web server depends on your choice of authentication. Comment out the modules you don't -need from the following: -LoadModule authn_file_module modules/mod_authn_file.so -LoadModule authn_dbm_module modules/mod_authn_dbm.so -authn_alias allows for authentication based on aliases. authn_anon -allows anonymous authentication similar to that of anonymous ftp sites. authz_owner -allows authorization based on file ownership. authz_dbm allows for authorization -based on group membership if the web server is using DBM authentication. - -If the above functionality is unnecessary, comment out the related module: -#LoadModule authn_alias_module modules/mod_authn_alias.so -#LoadModule authn_anon_module modules/mod_authn_anon.so -#LoadModule authz_owner_module modules/mod_authz_owner.so -#LoadModule authz_dbm_module modules/mod_authz_dbm.so - - - Minimize Configuration Files Included - The Include directive directs httpd to load supplementary configuration files -from a provided path. The default configuration loads all files that end in .conf -from the /etc/httpd/conf.d directory. - -To restrict excess configuration, the following line should be commented out and -replaced with Include directives that only reference required configuration files: -#Include conf.d/*.conf -If the above change was made, ensure that the SSL encryption remains loaded by -explicitly including the corresponding configuration file: -Include conf.d/ssl.conf -If PHP is necessary, a similar alteration must be made: -Include conf.d/php.conf - -Explicitly listing the configuration files to be loaded during web server start-up avoids -the possibility of unwanted or malicious configuration files to be automatically included as -part of the server's running configuration. - - - Minimize Various Optional Components - The following modules perform very specific tasks, sometimes providing access to -just a few additional directives. If such functionality is not required (or if you -are not using these directives), comment out the associated module: -External filtering (response passed through external program prior to client delivery) -#LoadModule ext_filter_module modules/mod_ext_filter.soUser-specified Cache Control and Expiration -#LoadModule expires_module modules/mod_expires.soCompression Output Filter (provides content compression prior to client delivery) -#LoadModule deflate_module modules/mod_deflate.soHTTP Response/Request Header Customization -#LoadModule headers_module modules/mod_headers.soUser activity monitoring via cookies -#LoadModule usertrack_module modules/mod_usertrack.soDynamically configured mass virtual hosting -#LoadModule vhost_alias_module modules/mod_vhost_alias.so -Minimizing the number of loadable modules available to the web server reduces risk -by limiting the capabilities allowed by the web server. - - - - - Use Appropriate Modules to Improve httpd's Security - Among the modules available for httpd are several whose use may improve the -security of the web server installation. This section recommends and discusses -the deployment of security-relevant modules. - - Deploy mod_security - The security module provides an application level firewall for httpd. -Following its installation with the base ruleset, specific configuration advice can be found at - - http://www.modsecurity.org/ to design a policy that best matches the security needs of -the web applications. Usage of mod_security is highly recommended for some environments, -but it should be noted this module does not ship with Red Hat Enterprise Linux itself, -and instead is provided via Extra Packages for Enterprise Linux (EPEL). -For more information on EPEL please refer to - http://fedoraproject.org/wiki/EPEL. - - - Deploy mod_ssl - Because HTTP is a plain text protocol, all traffic is susceptible to passive -monitoring. If there is a need for confidentiality, SSL should be configured -and enabled to encrypt content. - -Note: mod_nss is a FIPS 140-2 certified alternative to mod_ssl. -The modules share a considerable amount of code and should be nearly identical -in functionality. If FIPS 140-2 validation is required, then mod_nss should -be used. If it provides some feature or its greater compatibility is required, -then mod_ssl should be used. - - - - Restrict Web Server Information Leakage - The ServerTokens and ServerSignature directives determine how -much information the web server discloses about the configuration of the -system. - - - Configure HTTPD-Served Web Content Securely - Running httpd inside a chroot jail is designed to isolate the -web server process to a small section of the filesystem, limiting the damage if -it is compromised. Versions of Apache greater than 2.2.10 (such as the one -included with Red Hat Enterprise Linux 7) provide the ChrootDir directive. To run Apache -inside a chroot jail in /chroot/apache, add the following line to -/etc/httpd/conf/httpd.conf: ChrootDir /chroot/apache This -necessitates placing all files required by httpd inside -/chroot/apache , including httpd's binaries, modules, -configuration files, and served web pages. The details of this configuration -are beyond the scope of this guide. This may also require additional SELinux -configuration. - - Web Login Banner Verbiage - Enter an appropriate login banner for your organization. Please note that new lines must -be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'. - ^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$ - ^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$ - ^I've[\s\n]+read[\s\n]+\&[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$ - ^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$ - ^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$ - - - - Use Denial-of-Service Protection Modules - Denial-of-service attacks are difficult to detect and prevent while maintaining -acceptable access to authorized users. However, some traffic-shaping -modules can be used to address the problem. Well-known DoS protection modules include: -mod_cband mod_bwshare mod_limitipconn mod_evasive -Denial-of-service prevention should be implemented for a web server if such a threat exists. -However, specific configuration details are very dependent on the environment and often best left -at the discretion of the administrator. - - - - - IMAP and POP3 Server - Dovecot provides IMAP and POP3 services. It is not -installed by default. The project page at - http://www.dovecot.org -contains more detailed information about Dovecot -configuration. - - Configure Dovecot if Necessary - If the system will operate as an IMAP or -POP3 server, the dovecot software should be configured securely by following -the recommendations below. - - Allow IMAP Clients to Access the Server - -The default iptables configuration does not allow inbound access to any services. -This modification will allow remote hosts to initiate connections to the IMAP daemon, -while keeping all other ports on the server in their default protected state. -To configure iptables to allow port 143 traffic, one must edit -/etc/sysconfig/iptables and -/etc/sysconfig/ip6tables (if IPv6 is in use). -Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain: --A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT - - - Enable SSL Support - SSL should be used to encrypt network traffic between the -Dovecot server and its clients. Users must authenticate to the Dovecot -server in order to read their mail, and passwords should never be -transmitted in clear text. In addition, protecting mail as it is -downloaded is a privacy measure, and clients may use SSL certificates -to authenticate the server, preventing another system from impersonating -the server. - - - Support Only the Necessary Protocols - Dovecot supports the IMAP and POP3 protocols, as well as -SSL-protected versions of those protocols. Configure the Dovecot server -to support only the protocols needed by your site. Edit /etc/dovecot/dovecot.conf. -Add or correct the following lines, replacing PROTOCOL with -only the subset of protocols (imap, imaps, -pop3, pop3s) required: -protocols = PROTOCOL -If possible, require SSL protection for all transactions. The SSL -protocol variants listen on alternate ports (995 instead of 110 for -pop3s, and 993 instead of 143 for imaps), and require SSL-aware clients. -An alternate approach is to listen on the standard port and require the -client to use the STARTTLS command before authenticating. - - - - Disable Dovecot - If the system does not need to operate as an IMAP or -POP3 server, the dovecot software should be disabled and removed. - - - - Kerberos - The Kerberos protocol is used for authentication across -non-secure network. Authentication can happen between -various types of principals -- users, service, or hosts. -Their identity and encryption keys can be stored in keytab -files. - - - Disable Kerberos by removing host keytab - Kerberos is not an approved key distribution method for -Common Criteria. To prevent using Kerberos by system daemons, -remove the Kerberos keytab files, especially -/etc/krb5.keytab. - CCI-000803 - 0418 - 1055 - 1402 - FTP_ITC_EXT.1 - SRG-OS-000120-GPOS-00061 - The key derivation function (KDF) in Kerberos is not FIPS compatible. - - - - - - - - - - - LDAP - LDAP is a popular directory service, that is, a -standardized way of looking up information from a central database. -Red Hat Enterprise Linux CoreOS 4 includes software that enables a system to act as both -an LDAP client and server. - - Configure OpenLDAP Clients - This section provides information on which security settings are -important to configure in OpenLDAP clients by manually editing the appropriate -configuration files. Red Hat Enterprise Linux CoreOS 4 provides an automated configuration tool called -authconfig and a graphical wrapper for authconfig called -system-config-authentication. However, these tools do not provide as -much control over configuration as manual editing of configuration files. The -authconfig tools do not allow you to specify locations of SSL certificate -files, which is useful when trying to use SSL cleanly across several protocols. -Installation and configuration of OpenLDAP on Red Hat Enterprise Linux CoreOS 4 is available at - Before configuring any system to be an -LDAP client, ensure that a working LDAP server is present on the -network. - - Ensure LDAP client is not installed - The Lightweight Directory Access Protocol (LDAP) is a service that provides -a method for looking up information from a central database. -The openldap-clients package can be removed with the following command: - - If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface. - - - - - - - - - - Configure OpenLDAP Server - This section details some security-relevant settings -for an OpenLDAP server. - - Install and Protect LDAP Certificate Files - Create the PKI directory for LDAP certificates if it does not already exist: -$ sudo mkdir /etc/pki/tls/ldap -$ sudo chown root:root /etc/pki/tls/ldap -$ sudo chmod 755 /etc/pki/tls/ldap -Using removable media or some other secure transmission format, install the certificate files -onto the LDAP server: -/etc/pki/tls/ldap/serverkey.pem: the private key ldapserverkey.pem/etc/pki/tls/ldap/servercert.pem: the certificate file ldapservercert.pem -Verify the ownership and permissions of these files: -$ sudo chown root:ldap /etc/pki/tls/ldap/serverkey.pem -$ sudo chown root:ldap /etc/pki/tls/ldap/servercert.pem -$ sudo chmod 640 /etc/pki/tls/ldap/serverkey.pem -$ sudo chmod 640 /etc/pki/tls/ldap/servercert.pem -Verify that the CA's public certificate file has been installed as -/etc/pki/tls/CA/cacert.pem, and has the correct permissions: -$ sudo mkdir /etc/pki/tls/CA -$ sudo chown root:root /etc/pki/tls/CA/cacert.pem -$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem - -As a result of these steps, the LDAP server will have access to its own private -certificate and the key with which that certificate is encrypted, and to the -public certificate file belonging to the CA. Note that it would be possible for -the key to be protected further, so that processes running as ldap could not -read it. If this were done, the LDAP server process would need to be restarted -manually whenever the server rebooted. - - - - - Mail Server Software - Mail servers are used to send and receive email over the network. -Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious -targets of network attack. -Ensure that systems are not running MTAs unnecessarily, -and configure needed MTAs as defensively as possible. - -Very few systems at any site should be configured to directly receive email over the -network. Users should instead use mail client programs to retrieve email -from a central server that supports protocols such as IMAP or POP3. -However, it is normal for most systems to be independently capable of sending email, -for instance so that cron jobs can report output to an administrator. -Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from -the local system to a central site MTA (or directly delivered to a local account), -but the system still cannot receive mail directly over a network. - -The alternatives program in Red Hat Enterprise Linux CoreOS 4 permits selection of other mail server software -(such as Sendmail), but Postfix is the default and is preferred. -Postfix was coded with security in mind and can also be more effectively contained by -SELinux as its modular design has resulted in separate processes performing specific actions. -More information is available on its website, - http://www.postfix.org. - - - The Postfix package is installed - A mail server is required for sending emails. -The postfix package can be installed with the following command: - - SRG-OS-000046-GPOS-00022 - Emails can be used to notify designated personnel about important -system events such as failures or warnings. - - - - - - - - - - Uninstall Sendmail Package - Sendmail is not the default mail transfer agent and is -not installed by default. -The sendmail package can be removed with the following command: - - BP28(R1) - 11 - 14 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.05 - DSS06.06 - CCI-000381 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - PR.PT-3 - SRG-OS-000480-GPOS-00227 - SRG-OS-000095-GPOS-00049 - The sendmail software was not developed with security in mind and -its design prevents it from being effectively contained by SELinux. Postfix -should be used instead. - - - - - - - - - - Configure SMTP For Mail Clients - This section discusses settings for Postfix in a submission-only -e-mail configuration. - - - Postfix Network Interfaces - The setting for inet_interfaces in /etc/postfix/main.cf - loopback-only - loopback-only - localhost - - - Postfix relayhost - Specify the host all outbound email should be routed into. - smtp.$mydomain - - - Postfix Root Mail Alias - Specify an email address (string) for a root mail alias. - system.administrator@mail.mil - - - Configure System to Forward All Mail For The Root Account - Make sure that mails delivered to root user are forwarded to a monitored -email address. Make sure that the address - is a valid email address -reachable from the system in question. Use the following command to -configure the alias: -$ sudo echo "root: " >> /etc/aliases -$ sudo newaliases - BP28(R49) - CCI-000139 - CCI-000366 - CM-6(a) - SRG-OS-000046-GPOS-00022 - A number of system services utilize email messages sent to the root user to -notify system administrators of active or impending issues. These messages must -be forwarded to at least one monitored email address. - - - - - - - - - - - Configure System to Forward All Mail From Postmaster to The Root Account - Verify the administrators are notified in the event of an audit processing failure. -Check that the "/etc/aliases" file has a defined value for "root". -$ sudo grep "postmaster:\s*root$" /etc/aliases - -postmaster: root - CCI-000139 - AU-5(a) - AU-5.1(ii) - SRG-OS-000046-GPOS-00022 - It is critical for the appropriate personnel to be aware if a system is at risk of failing to -process audit logs as required. Without this notification, the security personnel may be -unaware of an impending failure of the audit capability, and system operation may be adversely -affected. - -Audit processing failures include software/hardware errors, failures in the audit capturing -mechanisms, and audit storage capacity being reached or exceeded. - - - - - - - - - - Configure System to Forward All Mail through a specific host - Set up a relay host that will act as a gateway for all outbound email. -Edit the file /etc/postfix/main.cf to ensure that only the following -relayhost line appears: -relayhost = - A central outbound email location ensures messages sent from any network host -can be audited for potential unexpected content. Tooling on the central server -may help prevent spam or viruses from being delivered. - - - - - - - - Configure Operating System to Protect Mail Server - The guidance in this section is appropriate for any host which is -operating as a site MTA, whether the mail server runs using Sendmail, Postfix, -or some other software. - - - Configure SSL Certificates for Use with SMTP AUTH - If SMTP AUTH is to be used, the use of SSL to protect credentials in transit is strongly recommended. -There are also configurations for which it may be desirable to encrypt all mail in transit from one MTA to another, -though such configurations are beyond the scope of this guide. In either event, the steps for creating and installing -an SSL certificate are independent of the MTA in use, and are described here. - - - Ensure Security of Postfix SSL Certificate - Create the PKI directory for mail certificates, if it does not already exist: -$ sudo mkdir /etc/pki/tls/mail -$ sudo chown root:root /etc/pki/tls/mail -$ sudo chmod 755 /etc/pki/tls/mail -Using removable media or some other secure transmission format, install the files generated in the previous -step onto the mail server: -/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem -/etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem -Verify the ownership and permissions of these files: -$ sudo chown root:root /etc/pki/tls/mail/serverkey.pem -$ sudo chown root:root /etc/pki/tls/mail/servercert.pem -$ sudo chmod 600 /etc/pki/tls/mail/serverkey.pem -$ sudo chmod 644 /etc/pki/tls/mail/servercert.pem -Verify that the CA's public certificate file has been installed as /etc/pki/tls/CA/cacert.pem, and has the -correct permissions: -$ sudo chown root:root /etc/pki/tls/CA/cacert.pem -$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem - - - - - Configure Postfix if Necessary - Postfix stores its configuration files in the directory -/etc/postfix by default. The primary configuration file is -/etc/postfix/main.cf. - - - Configure Postfix Resource Usage to Limit Denial of Service Attacks - Edit /etc/postfix/main.cf. Edit the following lines to -configure the amount of system resources Postfix can consume: -default_process_limit = 100 -smtpd_client_connection_count_limit = 10 -smtpd_client_connection_rate_limit = 30 -queue_minfree = 20971520 -header_size_limit = 51200 -message_size_limit = 10485760 -smtpd_recipient_limit = 100 -The values here are examples. - Note: The values given here are examples, and may -need to be modified for any particular site. By default, the Postfix anvil -process gathers mail receipt statistics. To get information about about what -connection rates are typical at your site, look in /var/log/maillog -for lines with the daemon name postfix/anvil. - - - - Control Mail Relaying - Postfix's mail relay controls are implemented with the help of the -smtpd recipient restrictions option, which controls the restrictions placed on -the SMTP dialogue once the sender and recipient envelope addresses are known. -The guidance in the following sections should be applied to all systems. If -there are systems which must be allowed to relay mail, but which cannot be -trusted to relay unconditionally, configure SMTP AUTH with SSL support. - - - Enact SMTP Recipient Restrictions - To configure Postfix to restrict addresses to which it -will send mail, see: - - http://www.postfix.org/SMTPD_ACCESS_README.html#danger - -The full contents of smtpd_recipient_restrictions will -vary by site, since this is a common place to put spam restrictions and other -site-specific options. The permit_mynetworks option allows all mail to -be relayed from the systems in mynetworks. Then, the -reject_unauth_destination option denies all mail whose destination -address is not local, preventing any other systems from relaying. These two -options should always appear in this order, and should usually follow one -another immediately unless SMTP AUTH is used. - - - - Enact SMTP Relay Restrictions - To configure Postfix to restrict addresses to which it -will send mail, see: - - http://www.postfix.org/SMTPD_ACCESS_README.html#danger - -The full contents of smtpd_recipient_restrictions will -vary by site, since this is a common place to put spam restrictions and other -site-specific options. The permit_mynetworks option allows all mail to -be relayed from the systems in mynetworks. Then, the -reject_unauth_destination option denies all mail whose destination -address is not local, preventing any other systems from relaying. These two -options should always appear in this order, and should usually follow one -another immediately unless SMTP AUTH is used. - - - - Use TLS for SMTP AUTH - Postfix provides options to use TLS for certificate-based -authentication and encrypted sessions. An encrypted session protects the -information that is transmitted with SMTP mail or with SASL authentication. -To configure Postfix to protect all SMTP AUTH transactions -using TLS, see - http://www.postfix.org/TLS_README.html. - - - - Configure Trusted Networks and Hosts - Edit /etc/postfix/main.cf, and configure the contents of -the mynetworks variable in one of the following ways: -If any system in the subnet containing the MTA may be trusted to relay -messages, add or correct the following line: -mynetworks_style = subnet -This is also the default setting, and is in effect if all -my_networks_style directives are commented.If only the MTA host itself is trusted to relay messages, add or correct -the following line: -mynetworks_style = hostIf the set of systems which can relay is more complicated, manually -specify an entry for each netblock or IP address which is trusted to relay by -setting the mynetworks variable directly: -mynetworks = 10.0.0.0/16, 192.168.1.0/24, 127.0.0.1 - - - - Require SMTP AUTH Before Relaying from Untrusted Clients - SMTP authentication allows remote clients to relay mail safely by -requiring them to authenticate before submitting mail. Postfix's SMTP AUTH uses -an authentication library called SASL, which is not part of Postfix itself. To -enable the use of SASL authentication, see - - http://www.postfix.org/SASL_README.html - - - - - - - - NFS and RPC - The Network File System is a popular distributed filesystem for -the Unix environment, and is very widely deployed. This section discusses the -circumstances under which it is possible to disable NFS and its dependencies, -and then details steps which should be taken to secure -NFS's configuration. This section is relevant to systems operating as NFS -clients, as well as to those operating as NFS servers. - - Disable All NFS Services if Possible - If there is not a reason for the system to operate as either an -NFS client or an NFS server, follow all instructions in this section to disable -subsystems required by NFS. - The steps in this section will prevent a system -from operating as either an NFS client or an NFS server. Only perform these -steps on systems which do not need NFS at all. - - - Disable netfs if Possible - To determine if any network filesystems handled by netfs are -currently mounted on the system execute the following command: -$ mount -t nfs,nfs4,smbfs,cifs,ncpfs -If the command did not return any output then disable netfs. - - - Disable Network File Systems (netfs) - The netfs script manages the boot-time mounting of several types -of networked filesystems, of which NFS and Samba are the most common. If these -filesystem types are not in use, the script can be disabled, protecting the -system somewhat against accidental or malicious changes to /etc/fstab -and against flaws in the netfs script itself. - -The netfs service can be disabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-netfs-disable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: netfs.service - - -This will disable the netfs service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: netfs.service - enabled: false - mask: true - - name: netfs.socket - enabled: false - mask: true - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: netfs.service - enabled: false - mask: true - - name: netfs.socket - enabled: false - mask: true - - - - - - - - Disable Services Used Only by NFS - If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd. - -All of these daemons run with elevated privileges, and many listen for network -connections. If they are not needed, they should be disabled to improve system -security posture. - - - - - Configure All Systems which Use NFS - The steps in this section are appropriate for all systems which -run NFS, whether they operate as clients or as servers. - - Make Each System a Client or a Server, not Both - If NFS must be used, it should be deployed in the simplest -configuration possible to avoid maintainability problems which may lead to -unnecessary security exposure. Due to the reliability and security problems -caused by NFS (specially NFSv3 and NFSv2), it is not a good idea for systems -which act as NFS servers to also mount filesystems via NFS. At the least, -crossed mounts (the situation in which each of two servers mounts a filesystem -from the other) should never be used. - - - Configure NFS Services to Use Fixed Ports (NFSv3 and NFSv2) - Firewalling should be done at each host and at the border -firewalls to protect the NFS daemons from remote access, since NFS servers -should never be accessible from outside the organization. However, by default -for NFSv3 and NFSv2, the RPC Bind service assigns each NFS service to a port -dynamically at service startup time. Dynamic ports cannot be protected by port - -filtering firewalls such as iptables. - - -Therefore, restrict each service to always use a given port, so that -firewalling can be done effectively. Note that, because of the way RPC is -implemented, it is not possible to disable the RPC Bind service even if ports -are assigned statically to all RPC services. - -In NFSv4, the mounting and locking protocols have been incorporated into the -protocol, and the server listens on the the well-known TCP port 2049. As such, -NFSv4 does not need to interact with the rpcbind, lockd, and rpc.statd -daemons, which can and should be disabled in a pure NFSv4 environment. The -rpc.mountd daemon is still required on the NFS server to setup -exports, but is not involved in any over-the-wire operations. - - - - Configure NFS Clients - The steps in this section are appropriate for systems which operate as NFS clients. - - Disable NFS Server Daemons - There is no need to run the NFS server daemons nfs and -rpcsvcgssd except on a small number of properly secured systems -designated as NFS servers. Ensure that these daemons are turned off on -clients. - - - Mount Remote Filesystems with Restrictive Options - Edit the file /etc/fstab. For each filesystem whose type -(column 3) is nfs or nfs4, add the text -,nodev,nosuid to the list of mount options in column 4. If -appropriate, also add ,noexec. - -See the section titled "Restrict Partition Mount Options" for a description of -the effects of these options. In general, execution of files mounted via NFS -should be considered risky because of the possibility that an adversary could -intercept the request and substitute a malicious file. Allowing setuid files to -be executed from remote servers is particularly risky, both for this reason and -because it requires the clients to extend root-level trust to the NFS -server. - - - - - Configure NFS Servers - The steps in this section are appropriate for systems which operate as NFS servers. - - Ensure All-Squashing Disabled On All Exports - The all_squash maps all uids and gids to an anonymous user. -This should be disabled by removing any instances of the -all_squash option from the file /etc/exports. - The all_squash option maps all client requests to a single anonymous -uid/gid on the NFS server, negating the ability to track file access -by user ID. - - - - - - Configure the Exports File Restrictively - Linux's NFS implementation uses the file /etc/exports to control what filesystems -and directories may be accessed via NFS. (See the exports(5) manpage for more information about the -format of this file.) - -The syntax of the exports file is not necessarily checked fully on reload, and syntax errors -can leave your NFS configuration more open than intended. Therefore, exercise caution when modifying -the file. - -The syntax of each line in /etc/exports is: -/DIR host1(opt1,opt2) host2(opt3) -where /DIR is a directory or filesystem to export, hostN is an IP address, netblock, -hostname, domain, or netgroup to which to export, and optN is an option. - - - Export Filesystems Read-Only if Possible - If a filesystem is being exported so that users can view the files in a convenient -fashion, but there is no need for users to edit those files, exporting the filesystem read-only -removes an attack vector against the server. The default filesystem export mode is ro, -so do not specify rw without a good reason. - - - Use Access Lists to Enforce Authorization Restrictions - When configuring NFS exports, ensure that each export line in /etc/exports contains -a list of hosts which are allowed to access that export. If no hosts are specified on an export line, -then that export is available to any remote host which requests it. All lines of the exports file should -specify the hosts (or subnets, if needed) which are allowed to access the exported directory, so that -unknown or remote hosts will be denied. - -Authorized hosts can be specified in several different formats: -Name or alias that is recognized by the resolverFully qualified domain nameIP addressIP subnets in the format address/netmask or address/CIDR - - - - - Network Time Protocol - The Network Time Protocol is used to manage the system -clock over a network. Computer clocks are not very accurate, so -time will drift unpredictably on unmanaged systems. Central time -protocols can be used both to ensure that time is consistent among -a network of systems, and that their time is consistent with the -outside world. - -If every system on a network reliably reports the same time, then it is much -easier to correlate log messages in case of an attack. In addition, a number of -cryptographic protocols (such as Kerberos) use timestamps to prevent certain -types of attacks. If your network does not have synchronized time, these -protocols may be unreliable or even unusable. - -Depending on the specifics of the network, global time accuracy may be just as -important as local synchronization, or not very important at all. If your -network is connected to the Internet, using a public timeserver (or one -provided by your enterprise) provides globally accurate timestamps which may be -essential in investigating or responding to an attack which originated outside -of your network. - -A typical network setup involves a small number of internal systems operating -as NTP servers, and the remainder obtaining time information from those -internal servers. - -There is a choice between the daemons ntpd and chronyd, which -are available from the repositories in the ntp and chrony -packages respectively. - -The default chronyd daemon can work well when external time references -are only intermittently accesible, can perform well even when the network is -congested for longer periods of time, can usually synchronize the clock faster -and with better time accuracy, and quickly adapts to sudden changes in the rate -of the clock, for example, due to changes in the temperature of the crystal -oscillator. Chronyd should be considered for all systems which are -frequently suspended or otherwise intermittently disconnected and reconnected -to a network. Mobile and virtual systems for example. - -The ntpd NTP daemon fully supports NTP protocol version 4 (RFC 5905), -including broadcast, multicast, manycast clients and servers, and the orphan -mode. It also supports extra authentication schemes based on public-key -cryptography (RFC 5906). The NTP daemon (ntpd) should be considered -for systems which are normally kept permanently on. Systems which are required -to use broadcast or multicast IP, or to perform authentication of packets with -the Autokey protocol, should consider using ntpd. - -Refer to - - - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/ - -for more detailed comparison of features of chronyd -and ntpd daemon features respectively, and for further guidance how to -choose between the two NTP daemons. - -The upstream manual pages at - http://chrony.tuxfamily.org/manual.html for -chronyd and - http://www.ntp.org for ntpd provide additional -information on the capabilities and configuration of each of the NTP daemons. - - - Vendor Approved Time Servers - The list of vendor-approved time servers - 0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org - 0.fedora.pool.ntp.org,1.fedora.pool.ntp.org,2.fedora.pool.ntp.org,3.fedora.pool.ntp.org - 0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org - 0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org - 0.suse.pool.ntp.org,1.suse.pool.ntp.org,2.suse.pool.ntp.org,3.suse.pool.ntp.org - 0.ntp.cloud.aliyuncs.com,1.ntp.aliyun.com,2.ntp1.aliyun.com,3.ntp1.cloud.aliyuncs.com - - - Maximum NTP or Chrony Poll - The maximum NTP or Chrony poll interval number in seconds specified as a power of two. - 17 - 16 - 10 - 10 - - - The Chrony package is installed - System time should be synchronized between all systems in an environment. This is -typically done by establishing an authoritative time server or set of servers and having all -systems synchronize their clocks to them. -The chrony package can be installed with the following command: - - BP28(R43) - 0988 - 1405 - FMT_SMF_EXT.1 - SRG-OS-000355-GPOS-00143 - Time synchronization is important to support time sensitive security mechanisms like -Kerberos and also ensures log files have consistent time records across the enterprise, -which aids in forensic investigations. - - - - - - - - - - Install the ntp service - The ntpd service should be installed. - NT012(R03) - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000160 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - PR.PT-1 - Req-10.4 - Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906. - - - - - - - - - - The Chronyd service is enabled - chrony is a daemon which implements the Network Time Protocol (NTP) is designed to -synchronize system clocks across a variety of systems and use a source that is highly -accurate. More information on chrony can be found at - - http://chrony.tuxfamily.org/. -Chrony can be configured to be a client and/or a server. -To enable Chronyd service, you can run: -# systemctl enable chronyd.service -This recommendation only applies if chrony is in use on the system. - 0988 - 1405 - If chrony is in use on the system proper configuration is vital to ensuring time -synchronization is working properly. - - - - - - - - - - Enable the NTP Daemon - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -chronyd service: -$ sudo systemctl is-active chronyd -If the service is running, it should return the following: active -Note: The chronyd daemon is enabled by default. - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -ntpd service: -$ sudo systemctl is-active ntpd -If the service is running, it should return the following: active -Note: The ntpd daemon is not enabled by default. Though as mentioned -in the previous sections in certain environments the ntpd daemon might -be preferred to be used rather than the chronyd one. Refer to: - - - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite - -for guidance which NTP daemon to choose depending on the environment used. - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 3.3.7 - CCI-000160 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - 0988 - 1405 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(a) - AU-12(1) - PR.PT-1 - Req-10.4.1 - SRG-OS-000356-VMM-001340 - Enabling some of chronyd or ntpd services ensures -that the NTP daemon will be running and that the system will synchronize its -time to any servers specified. This is important whether the system is -configured to be a client (and synchronize only its own clock) or it is also -acting as an NTP server to other systems. Synchronizing time is essential for -authentication services such as Kerberos, but it is also important for -maintaining accurate logs and auditing possible security breaches. - -The chronyd and ntpd NTP daemons offer all of the -functionality of ntpdate, which is now deprecated. - - CCE-82682-6 - - - - - - - - - Enable the NTP Daemon - -The ntpd service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-ntpd-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: ntpd.service - enabled: true - - -This will enable the ntpd service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - NT012(R03) - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-000160 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(a) - PR.PT-1 - Req-10.4 - Enabling the ntpd service ensures that the ntpd -service will be running and that the system will synchronize its time to -any servers specified. This is important whether the system is configured to be -a client (and synchronize only its own clock) or it is also acting as an NTP -server to other systems. Synchronizing time is essential for authentication -services such as Kerberos, but it is also important for maintaining accurate -logs and auditing possible security breaches. - -The NTP daemon offers all of the functionality of ntpdate, which is now -deprecated. - - - - - - - - - - Enable the NTP Daemon - -The ntpd service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-ntpd-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: ntpd.service - enabled: true - - -This will enable the ntpd service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(a) - PR.PT-1 - Req-10.4 - Enabling the ntpd service ensures that the ntpd -service will be running and that the system will synchronize its time to -any servers specified. This is important whether the system is configured to be -a client (and synchronize only its own clock) or it is also acting as an NTP -server to other systems. Synchronizing time is essential for authentication -services such as Kerberos, but it is also important for maintaining accurate -logs and auditing possible security breaches. - -The NTP daemon offers all of the functionality of ntpdate, which is now -deprecated. - - - - - - - - - - Disable chrony daemon from acting as server - The port option in /etc/chrony.conf can be set to -0 to make chrony daemon to never open any listening port -for server operation and to operate strictly in a client-only mode. - CCI-000381 - AU-8(1) - AU-12(1) - FMT_SMF_EXT.1 - SRG-OS-000096-GPOS-00050 - SRG-OS-000095-GPOS-00049 - Minimizing the exposure of the server functionality of the chrony -daemon diminishes the attack surface. - - CCE-82465-6 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }} - mode: 420 - overwrite: true - path: /etc/chrony.conf - - contents: - source: data:, - mode: 420 - overwrite: true - path: /etc/chrony.d/.mco-keep - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }} - mode: 420 - overwrite: true - path: /etc/chrony.d/ntp-server.conf - - - - - - - - - - Disable network management of chrony daemon - The cmdport option in /etc/chrony.conf can be set to -0 to stop chrony daemon from listening on the UDP port 323 -for management connections made by chronyc. - CCI-000381 - CM-7(1) - FMT_SMF_EXT.1 - SRG-OS-000096-GPOS-00050 - SRG-OS-000095-GPOS-00049 - Not exposing the management interface of the chrony daemon on -the network diminishes the attack space. - - CCE-82466-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }} - mode: 420 - overwrite: true - path: /etc/chrony.conf - - contents: - source: data:, - mode: 420 - overwrite: true - path: /etc/chrony.d/.mco-keep - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }} - mode: 420 - overwrite: true - path: /etc/chrony.d/ntp-server.conf - - - - - - - - - - Configure Time Service Maxpoll Interval - The maxpoll should be configured to - in /etc/ntp.conf or -/etc/chrony.conf to continuously poll time servers. To configure -maxpoll in /etc/ntp.conf or /etc/chrony.conf -add the following after each `server`, `pool` or `peer` entry: -maxpoll -to server directives. If using chrony any pool directives -should be configured too. -If no server or pool directives are configured, the rule evaluates -to pass. - - -Note that if the remediation shipping with this content is being used, the -MachineConfig shipped does not include reference NTP servers to point -to. It is up to the admin to set these which will vary depending on the -cluster's requirements. - - - -The aforementioned remediation does include the directory /etc/chrony.d -which would allow the creation of configuration files to set these servers. - - -If we'd like to set a configuration like the following: - -pool 2.rhel.pool.ntp.org iburst - -server 0.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 1.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 2.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 3.rhel.pool.ntp.org minpoll 4 maxpoll 10 - - -This could be done with to the following manifest: - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-chrony-servers -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,pool%202.rhel.pool.ntp.org%20iburst%0A%0Aserver%200.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%201.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%202.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%203.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010 - mode: 0600 - path: /etc/chrony.d/10-rhel-pool-and-servers.conf - overwrite: true - - -Note that this needs to be done for each MachineConfigPool - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - CCI-001891 - CCI-002046 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(b) - AU-12(1) - PR.PT-1 - SRG-OS-000355-GPOS-00143 - SRG-OS-000356-GPOS-00144 - SRG-OS-000359-GPOS-00146 - Inaccurate time stamps make it more difficult to correlate -events and can lead to an inaccurate analysis. Determining the correct -time a particular event occurred on a system is critical when conducting -forensic analysis and investigating system events. Sources outside the -configured acceptable allowance (drift) may be inaccurate. - - CCE-82684-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }} - mode: 420 - overwrite: true - path: /etc/chrony.conf - - contents: - source: data:, - mode: 420 - overwrite: true - path: /etc/chrony.d/.mco-keep - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }} - mode: 420 - overwrite: true - path: /etc/chrony.d/ntp-server.conf - - - - - - - - - - - Specify Additional Remote NTP Servers - Depending on specific functional requirements of a concrete -production environment, the Red Hat Enterprise Linux CoreOS 4 system can be -configured to utilize the services of the chronyd NTP daemon (the -default), or services of the ntpd NTP daemon. Refer to - - - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite - -for more detailed comparison of the features of both of the choices, and for -further guidance how to choose between the two NTP daemons. - -Additional NTP servers can be specified for time synchronization. To do so, -perform the following: - if the system is configured to use the chronyd as the NTP daemon -(the default), edit the file /etc/chrony.conf as follows, if the system is configured to use the ntpd as the NTP daemon, -edit the file /etc/ntp.conf as documented below. -Add additional lines of the following form, substituting the IP address or -hostname of a remote NTP server for ntpserver: -server ntpserver - - -Note that if the remediation shipping with this content is being used, the -MachineConfig shipped does not include reference NTP servers to point -to. It is up to the admin to set these which will vary depending on the -cluster's requirements. - - - -The aforementioned remediation does include the directory /etc/chrony.d -which would allow the creation of configuration files to set these servers. - - -If we'd like to set a configuration like the following: - - -pool 2.rhel.pool.ntp.org iburst - -server 0.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 1.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 2.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 3.rhel.pool.ntp.org minpoll 4 maxpoll 10 - - -This could be done with to the following manifest: - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-chrony-servers -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,pool%202.rhel.pool.ntp.org%20iburst%0A%0Aserver%200.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%201.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%202.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%203.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010 - mode: 0600 - path: /etc/chrony.d/10-rhel-pool-and-servers.conf - overwrite: true - - -Note that this needs to be done for each MachineConfigPool - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - 0988 - 1405 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(a) - AU-8(2) - AU-12(1) - PR.PT-1 - Req-10.4.3 - Specifying additional NTP servers increases the availability of -accurate time data, in the event that one of the specified servers becomes -unavailable. This is typical for a system acting as an NTP server for -other systems. - - CCE-82685-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }} - mode: 420 - overwrite: true - path: /etc/chrony.conf - - contents: - source: data:, - mode: 420 - overwrite: true - path: /etc/chrony.d/.mco-keep - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }} - mode: 420 - overwrite: true - path: /etc/chrony.d/ntp-server.conf - - - - - - - Specify a Remote NTP Server - Depending on specific functional requirements of a concrete -production environment, the Red Hat Enterprise Linux CoreOS 4 system can be -configured to utilize the services of the chronyd NTP daemon (the -default), or services of the ntpd NTP daemon. Refer to - - - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite - -for more detailed comparison of the features of both of the choices, and for -further guidance how to choose between the two NTP daemons. - -To specify a remote NTP server for time synchronization, perform the following: - if the system is configured to use the chronyd as the NTP daemon (the -default), edit the file /etc/chrony.conf as follows, if the system is configured to use the ntpd as the NTP daemon, -edit the file /etc/ntp.conf as documented below. -Add or correct the following lines, substituting the IP or hostname of a remote -NTP server for ntpserver: -server ntpserver -This instructs the NTP software to contact that remote server to obtain time -data. - - -Note that if the remediation shipping with this content is being used, the -MachineConfig shipped does not include reference NTP servers to point -to. It is up to the admin to set these which will vary depending on the -cluster's requirements. - - - -The aforementioned remediation does include the directory /etc/chrony.d -which would allow the creation of configuration files to set these servers. - - -If we'd like to set a configuration like the following: - - -pool 2.rhel.pool.ntp.org iburst - -server 0.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 1.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 2.rhel.pool.ntp.org minpoll 4 maxpoll 10 -server 3.rhel.pool.ntp.org minpoll 4 maxpoll 10 - - -This could be done with to the following manifest: - - -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-chrony-servers -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,pool%202.rhel.pool.ntp.org%20iburst%0A%0Aserver%200.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%201.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%202.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010%0Aserver%203.rhel.pool.ntp.org%20minpoll%204%20maxpoll%2010 - mode: 0600 - path: /etc/chrony.d/10-rhel-pool-and-servers.conf - overwrite: true - - -Note that this needs to be done for each MachineConfigPool - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 3.3.7 - CCI-000160 - CCI-001891 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(a) - AU-8(2) - AU-12(1) - PR.PT-1 - Req-10.4.1 - Req-10.4.3 - SRG-OS-000355-VMM-001330 - Synchronizing with an NTP server makes it possible to collate system -logs from multiple sources or correlate computer events with real time events. - - CCE-82683-4 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }} - mode: 420 - overwrite: true - path: /etc/chrony.conf - - contents: - source: data:, - mode: 420 - overwrite: true - path: /etc/chrony.d/.mco-keep - - contents: - source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }} - mode: 420 - overwrite: true - path: /etc/chrony.d/ntp-server.conf - - - - - - - - - - Ensure Chrony is only configured with the server directive - Check that Chrony only has time sources configured with the server directive. - This rule doesn't come with a remediation, the time source needs to be added by the adminstrator. - CCI-001891 - SRG-OS-000355-GPOS-00143 - SRG-OS-000356-GPOS-00144 - SRG-OS-000359-GPOS-00146 - Depending on the infrastruture being used the pool directive may not be supported. - - - - - - - - - - A remote time server for Chrony is configured - Chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to -synchronize system clocks across a variety of systems and use a source that is highly -accurate. More information on chrony can be found at - - http://chrony.tuxfamily.org/. -Chrony can be configured to be a client and/or a server. -Add or edit server or pool lines to /etc/chrony.conf as appropriate: -server <remote-server> -Multiple servers may be configured. - BP28(R43) - CCI-000160 - CCI-001891 - 0988 - 1405 - CM-6(a) - AU-8(1)(a) - Req-10.4.3 - If chrony is in use on the system proper configuration is vital to ensuring time -synchronization is working properly. - - - - - - - - - - Specify Additional Remote NTP Servers - Additional NTP servers can be specified for time synchronization -in the file /etc/ntp.conf. To do so, add additional lines of the -following form, substituting the IP address or hostname of a remote NTP server for -ntpserver: -server ntpserver - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(a) - AU-8(2) - PR.PT-1 - Req-10.4.3 - Specifying additional NTP servers increases the availability of -accurate time data, in the event that one of the specified servers becomes -unavailable. This is typical for a system acting as an NTP server for -other systems. - - - - - - - Specify a Remote NTP Server - To specify a remote NTP server for time synchronization, edit -the file /etc/ntp.conf. Add or correct the following lines, -substituting the IP or hostname of a remote NTP server for ntpserver: -server ntpserver -This instructs the NTP software to contact that remote server to obtain time -data. - 1 - 14 - 15 - 16 - 3 - 5 - 6 - APO11.04 - BAI03.05 - DSS05.04 - DSS05.07 - MEA02.01 - 4.3.3.3.9 - 4.3.3.5.8 - 4.3.4.4.7 - 4.4.2.1 - 4.4.2.2 - 4.4.2.4 - SR 2.10 - SR 2.11 - SR 2.12 - SR 2.8 - SR 2.9 - A.12.4.1 - A.12.4.2 - A.12.4.3 - A.12.4.4 - A.12.7.1 - CM-6(a) - AU-8(1)(a) - PR.PT-1 - Req-10.4.1 - Req-10.4.3 - Synchronizing with an NTP server makes it possible -to collate system logs from multiple sources or correlate computer events with -real time events. - - - - - - - - - - - Obsolete Services - This section discusses a number of network-visible -services which have historically caused problems for system -security, and for which disabling or severely limiting the service -has been the best available guidance for some time. As a result of -this, many of these services are not installed as part of Red Hat Enterprise Linux CoreOS 4 -by default. - -Organizations which are running these services should -switch to more secure equivalents as soon as possible. -If it remains absolutely necessary to run one of -these services for legacy reasons, care should be taken to restrict -the service as much as possible, for instance by configuring host - -firewall software such as iptables to restrict access to the - -vulnerable service to only those remote hosts which have a known -need to use it. - - Xinetd - The xinetd service acts as a dedicated listener for some -network services (mostly, obsolete ones) and can be used to provide access -controls and perform some logging. It has been largely obsoleted by other -features, and it is not installed by default. The older Inetd service -is not even available as part of Red Hat Enterprise Linux CoreOS 4. - - - - NIS - The Network Information Service (NIS), also known as 'Yellow -Pages' (YP), and its successor NIS+ have been made obsolete by -Kerberos, LDAP, and other modern centralized authentication -services. NIS should not be used because it suffers from security -problems inherent in its design, such as inadequate protection of -important authentication information. - - - Rlogin, Rsh, and Rexec - The Berkeley r-commands are legacy services which -allow cleartext remote access and have an insecure trust -model. - - Remove Rsh Trust Files - The files /etc/hosts.equiv and ~/.rhosts (in -each user's home directory) list remote hosts and users that are trusted by the -local system when using the rshd daemon. -To remove these files, run the following command to delete them from any -location: -$ sudo rm /etc/hosts.equiv -$ rm ~/.rhosts - 11 - 12 - 14 - 15 - 3 - 8 - 9 - APO13.01 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.05 - DSS06.06 - CCI-001436 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - A.11.2.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.2.1 - A.6.2.2 - A.9.1.2 - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-3 - PR.IP-1 - PR.PT-3 - PR.PT-4 - This action is only meaningful if .rhosts support is permitted -through PAM. Trust files are convenient, but when used in conjunction with -the R-services, they can allow unauthenticated access to a system. - - - - - - - - - - Chat/Messaging Services - The talk software makes it possible for users to send and receive messages -across systems through a terminal session. - - - Telnet - The telnet protocol does not provide confidentiality or integrity -for information transmitted on the network. This includes authentication -information such as passwords. Organizations which use telnet should be -actively working to migrate to a more secure protocol. - - - TFTP Server - TFTP is a lightweight version of the FTP protocol which has -traditionally been used to configure networking equipment. However, -TFTP provides little security, and modern versions of networking -operating systems frequently support configuration via SSH or other -more secure protocols. A TFTP server should be run only if no more -secure method of supporting existing equipment can be -found. - - TFTP server secure directory - Specify the directory which is used by TFTP server as a root directory when running in secure mode. - /var/lib/tftpboot - - - - - Print Support - The Common Unix Printing System (CUPS) service provides both local -and network printing support. A system running the CUPS service can accept -print jobs from other systems, process them, and send them to the appropriate -printer. It also provides an interface for remote administration through a web -browser. The CUPS service is installed and activated by default. The project -homepage and more detailed documentation are available at - - http://www.cups.org. - - - Configure the CUPS Service if Necessary - CUPS provides the ability to easily share local printers with -other systems over the network. It does this by allowing systems to share -lists of available printers. Additionally, each system that runs the CUPS -service can potentially act as a print server. Whenever possible, the printer -sharing and print server capabilities of CUPS should be limited or disabled. -The following recommendations should demonstrate how to do just that. - - - - Proxy Server - A proxy server is a very desirable target for a -potential adversary because much (or all) sensitive data for a -given infrastructure may flow through it. Therefore, if one is -required, the system acting as a proxy server should be dedicated -to that purpose alone and be stored in a physically secure -location. The system's default proxy server software is Squid, and -provided in an RPM package of the same name. - - Disable Squid if Possible - If Squid was installed and activated, but the system -does not need to act as a proxy server, then it should be disabled -and removed. - - - - Remote Authentication Dial-In User Service (RADIUS) - Remote Authentication Dial-In User Service (RADIUS) is a networking -protocol, operating on port 1812 that provides centralized -Authentication, Authorization, and Accounting (AAA or Triple A) -management for users who connect and use a network service. - - - Hardware RNG Entropy Gatherer Daemon - The rngd feeds random data from hardware device to kernel random device. - - - Enable the Hardware RNG Entropy Gatherer Service - The Hardware RNG Entropy Gatherer service should be enabled. - -The rngd service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-rngd-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: rngd.service - enabled: true - - -This will enable the rngd service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - CCI-000366 - FCS_RBG_EXT.1 - SRG-OS-000480-GPOS-00227 - The rngd service -feeds random data from hardware device to kernel random device. - - CCE-82535-6 - - - - - - - - - - Network Routing - A router is a very desirable target for a -potential adversary because they fulfill a variety of -infrastructure networking roles such as access to network segments, -gateways to other networks, filtering, etc. Therefore, if one is -required, the system acting as a router should be dedicated -to that purpose alone and be stored in a physically secure -location. The system's default routing software is Quagga, and -provided in an RPM package of the same name. - - Disable Quagga if Possible - If Quagga was installed and activated, but the system -does not need to act as a router, then it should be disabled -and removed. - - - - Samba(SMB) Microsoft Windows File Sharing Server - When properly configured, the Samba service allows -Linux systems to provide file and print sharing to Microsoft -Windows systems. There are two software packages that provide -Samba support. The first, samba-client, provides a series of -command line tools that enable a client system to access Samba -shares. The second, simply labeled samba, provides the Samba -service. It is this second package that allows a Linux system to -act as an Active Directory server, a domain controller, or as a -domain member. Only the samba-client package is installed by -default. - - Configure Samba if Necessary - All settings for the Samba daemon can be found in -/etc/samba/smb.conf. Settings are divided between a -[global] configuration section and a series of user -created share definition sections meant to describe file or print -shares on the system. By default, Samba will operate in user mode -and allow client systems to access local home directories and -printers. It is recommended that these settings be changed or that -additional limitations be set in place. - - Install the Samba Common Package - The samba-common package should be installed. -The samba-common package can be installed with the following command: - - If the samba-common package is not installed, samba cannot be configured. - - - - - - - - - Restrict Printer Sharing - By default, Samba utilizes the CUPS printing service to enable -printer sharing with Microsoft Windows workstations. If there are no printers -on the local system, or if printer sharing with Microsoft Windows is not -required, disable the printer sharing capability by commenting out the -following lines, found in /etc/samba/smb.conf: -[global] - load printers = yes - cups options = raw -[printers] - comment = All Printers - path = /usr/spool/samba - browseable = no - guest ok = no - writable = no - printable = yes -There may be other options present, but these are the only options enabled and -uncommented by default. Removing the [printers] share should be enough -for most users. If the Samba printer sharing capability is needed, consider -disabling the Samba network browsing capability or restricting access to a -particular set of users or network addresses. Set the valid users -parameter to a small subset of users or restrict it to a particular group of -users with the shorthand @. Separate each user or group of users with -a space. For example, under the [printers] share: -[printers] - valid users = user @printerusers - - - Restrict SMB File Sharing to Configured Networks - Only users with local user accounts will be able to log in to -Samba shares by default. Shares can be limited to particular users or network -addresses. Use the hosts allow and hosts deny directives -accordingly, and consider setting the valid users directive to a limited subset -of users or to a group of users. Separate each address, user, or user group -with a space as follows for a particular share or global: -[share] - hosts allow = 192.168.1. 127.0.0.1 - valid users = userone usertwo @usergroup -It is also possible to limit read and write access to particular users with the -read list and write list options, though the permissions set by the system -itself will override these settings. Set the read only attribute for each share -to ensure that global settings will not accidentally override the individual -share settings. Then, as with the valid users directive, separate each user or -group of users with a space: -[share] - read only = yes - write list = userone usertwo @usergroup - - - - Disable Samba if Possible - Even after the Samba server package has been installed, it -will remain disabled. Do not enable this service unless it is -absolutely necessary to provide Microsoft Windows file and print -sharing functionality. - - - - SNMP Server - The Simple Network Management Protocol allows -administrators to monitor the state of network devices, including -computers. Older versions of SNMP were well-known for weak -security, such as plaintext transmission of the community string -(used for authentication) and usage of easily-guessable -choices for the community string. - - Disable SNMP Server if Possible - The system includes an SNMP daemon that allows for its remote -monitoring, though it not installed by default. If it was installed and -activated but is not needed, the software should be disabled and removed. - - Uninstall net-snmp Package - -The net-snmp package provides the snmpd service. -The net-snmp package can be removed with the following command: - - If there is no need to run SNMP server software, -removing the package provides a safeguard against its -activation. - - - - - - - - - - Configure SNMP Server if Necessary - If it is necessary to run the snmpd agent on the system, some best -practices should be followed to minimize the security risk from the -installation. The multiple security models implemented by SNMP cannot be fully -covered here so only the following general configuration advice can be offered: -use only SNMP version 3 security models and enable the use of authentication and encryptionwrite access to the MIB (Management Information Base) should be allowed only if necessaryall access to the MIB should be restricted following a principle of least privilegenetwork access should be limited to the maximum extent possible including restricting to expected network -addresses both in the configuration files and in the system firewall rulesensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management -stationsensure that permissions on the snmpd.conf configuration file (by default, in /etc/snmp) are 640 or more restrictiveensure that any MIB files' permissions are also 640 or more restrictive - - SNMP read-only community string - Specify the SNMP community string used for read-only access. - changemero - - - SNMP read-write community string - Specify the SNMP community string used for read-write access. - changemerw - - - - - SSH Server - The SSH protocol is recommended for remote login and -remote file transfer. SSH provides confidentiality and integrity -for data exchanged between two systems, as well as server -authentication, through the use of public key cryptography. The -implementation included with the system is called OpenSSH, and more -detailed documentation is available from its website, - - https://www.openssh.com. -Its server program is called sshd and provided by the RPM package -openssh-server. - - - SSH enabled firewalld zone - Specify firewalld zone to enable SSH service. This value is used only for remediation purposes. - block - public - dmz - drop - external - home - internal - public - trusted - work - - - SSH Approved ciphers by FIPS - Specify the FIPS approved ciphers that are used for data integrity protection by the SSH server. - aes256-ctr,aes192-ctr,aes128-ctr - aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se - chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc - chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc - chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc - chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr - - - SSH Approved MACs by FIPS - Specify the FIPS approved MACs (message authentication code) algorithms - that are used for data integrity protection by the SSH server. - hmac-sha2-512,hmac-sha2-256 - hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com - umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com - umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com - umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com - hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 - - - SSH session Idle time - Specify duration of allowed idle time. - 600 - 7200 - 840 - 900 - 1800 - 300 - 3600 - 300 - - - SSH Server Listening Port - Specify port the SSH server is listening. - 22 - - - SSH Max authentication attempts - Specify the maximum number of authentication attempts per connection. - 10 - 3 - 4 - 5 - 4 - - - SSH is required to be installed - Specify if the Policy requires SSH to be installed. Used by SSH Rules -to determine if SSH should be uninstalled or configured. -A value of 0 means that the policy doesn't care if OpenSSH server is installed or not. If it is installed, scanner will check for it's configuration, if it's not installed, the check will pass. -A value of 1 indicates that OpenSSH server package is not required by the policy; -A value of 2 indicates that OpenSSH server package is required by the policy. - 0 - 1 - 2 - - - SSH Max Sessions Count - Specify the maximum number of open sessions permitted. - 10 - 4 - 3 - 2 - 1 - 0 - 10 - - - SSH Max Keep Alive Count - Specify the maximum number of idle message counts before session is terminated. - 10 - 3 - 5 - 0 - 1 - 0 - - - Install the OpenSSH Server Package - The openssh-server package should be installed. -The openssh-server package can be installed with the following command: - - 13 - 14 - APO01.06 - DSS05.02 - DSS05.04 - DSS05.07 - DSS06.02 - DSS06.06 - CCI-002418 - CCI-002420 - CCI-002421 - CCI-002422 - SR 3.1 - SR 3.8 - SR 4.1 - SR 4.2 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CM-6(a) - PR.DS-2 - PR.DS-5 - FIA_UAU.5 - FTP_ITC_EXT.1 - FCS_SSH_EXT.1 - FCS_SSHS_EXT.1 - SRG-OS-000423-GPOS-00187 - SRG-OS-000424-GPOS-00188 - SRG-OS-000425-GPOS-00189 - SRG-OS-000426-GPOS-00190 - Without protection of the transmitted information, confidentiality, and -integrity may be compromised because unprotected communications can be -intercepted and either read or altered. - - - - - - - - - - Remove the OpenSSH Server Package - The openssh-server package should be removed. -The openssh-server package can be removed with the following command: - - Without protection of the transmitted information, confidentiality, and -integrity may be compromised because unprotected communications can be -intercepted and either read or altered. - - - - - - - - - - Disable SSH Server If Possible (Unusual) - The SSH server service, sshd, is commonly needed. -However, if it can be disabled, do so. - - -The sshd service can be disabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-sshd-disable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - enabled: false - name: sshd.service - - -This will disable the sshd service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - - -This is unusual, as SSH is a common method for encrypted and authenticated -remote access. - CM-3(6) - IA-2(4) - - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: sshd.service - enabled: false - mask: true - - name: sshd.socket - enabled: false - mask: true - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: sshd.service - enabled: false - mask: true - - name: sshd.socket - enabled: false - mask: true - - - - - - - Verify Group Who Owns SSH Server config file - -To properly set the group owner of /etc/ssh/sshd_config, run the command: -$ sudo chgrp root /etc/ssh/sshd_config - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-17(a) - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - Service configuration files enable or disable features of their respective -services that if configured incorrectly can lead to insecure and vulnerable -configurations. Therefore, service configuration files should be owned by the -correct group to prevent unauthorized changes. - - - - - - - - - - Verify Owner on SSH Server config file - -To properly set the owner of /etc/ssh/sshd_config, run the command: -$ sudo chown root /etc/ssh/sshd_config - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-17(a) - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - Service configuration files enable or disable features of their respective -services that if configured incorrectly can lead to insecure and vulnerable -configurations. Therefore, service configuration files should be owned by the -correct group to prevent unauthorized changes. - - - - - - - - - - Verify Permissions on SSH Server config file - -To properly set the permissions of /etc/ssh/sshd_config, run the command: -$ sudo chmod 0600 /etc/ssh/sshd_config - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-17(a) - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - Service configuration files enable or disable features of their respective -services that if configured incorrectly can lead to insecure and vulnerable -configurations. Therefore, service configuration files should be owned by the -correct group to prevent unauthorized changes. - - - - - - - - - - Verify Permissions on SSH Server Private *_key Key Files - SSH server private keys - files that match the /etc/ssh/*_key glob, have to have restricted permissions. -If those files are owned by the root user and the root group, they have to have the 0640 permission or stricter. -If they are owned by the root user, but by a dedicated group ssh_keys, they can have the 0640 permission or stricter. - BP28(R36) - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.13 - 3.13.10 - CCI-000366 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-17(a) - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - If an unauthorized user obtains the private SSH host key file, the host could be -impersonated. - - - - - - - - - - Verify Permissions on SSH Server Public *.pub Key Files - To properly set the permissions of /etc/ssh/*.pub, run the command: $ sudo chmod 0644 /etc/ssh/*.pub - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.13 - 3.13.10 - CCI-000366 - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-17(a) - CM-6(a) - AC-6(1) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - If a public host key file is modified by an unauthorized user, the SSH service -may be compromised. - - - - - - - - - - Remove SSH Server iptables Firewall exception (Unusual) - By default, inbound connections to SSH's port are allowed. If the SSH -server is not being used, this exception should be removed from the -firewall configuration. - -Edit the files /etc/sysconfig/iptables and -/etc/sysconfig/ip6tables (if IPv6 is in use). In each file, locate -and delete the line: --A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -This is unusual, as SSH is a common method for encrypted and authenticated -remote access. - If inbound SSH connections are not expected, disallowing access to the SSH -port will avoid possible exploitation of the port by an attacker. - - - - Configure OpenSSH Client if Necessary - The following configuration changes apply to the SSH client. They can -improve security parameters relwevant to the client user, e.g. increasing -entropy while generating initialization vectors. Note that these changes -influence only the default SSH client configuration. Changes in this group -can be overridden by the client user by modifying files within the -~/.ssh directory or by supplying parameters on the command line. - - - Configure session renegotiation for SSH client - The RekeyLimit parameter specifies how often -the session key is renegotiated, both in terms of -amount of data that may be transmitted and the time -elapsed. To decrease the default limits, put line -RekeyLimit to file /etc/ssh/ssh_config.d/02-rekey-limit.conf. -Make sure that there is no other RekeyLimit configuration preceding -the include directive in the main config file -/etc/ssh/ssh_config. Check also other files in -/etc/ssh/ssh_config.d directory. Files are processed according to -lexicographical order of file names. Make sure that there is no file -processed before 02-rekey-limit.conf containing definition of -RekeyLimit. - CCI-000068 - FCS_SSH_EXT.1.8 - SRG-OS-000423-GPOS-00187 - SRG-OS-000033-GPOS-00014 - SRG-OS-000424-GPOS-00188 - By decreasing the limit based on the amount of data and enabling -time-based limit, effects of potential attacks against -encryption keys are limited. - - - - - - - - - - - - - Configure OpenSSH Server if Necessary - If the system needs to act as an SSH server, then -certain changes should be made to the OpenSSH daemon configuration -file /etc/ssh/sshd_config. The following recommendations can be -applied to this file. See the sshd_config(5) man page for more -detailed information. - - - SSH RekeyLimit - size - Specify the size component of the rekey limit. - default - 512M - 512M - 1G - - - SSH RekeyLimit - size - Specify the size component of the rekey limit. - none - 1h - 1h - - - SSH Compression Setting - Specify the compression setting for SSH connections. - no - delayed - no - - - SSH Privilege Separation Setting - Specify whether and how sshd separates privileges when handling incoming network connections. - no - yes - sandbox - sandbox - - - SSH LoginGraceTime setting - Configure parameters for how long the servers stays connected before the user has successfully logged in - 60 - 60 - - - SSH MaxStartups setting - Configure parameters for maximum concurrent unauthenticated connections to the SSH daemon. - 10:30:100 - 10:30:60 - - - Set SSH Client Alive Count Max to zero - The SSH server sends at most ClientAliveCountMax messages -during a SSH session and waits for a response from the SSH client. -The option ClientAliveInterval configures timeout after -each ClientAliveCountMax message. If the SSH server does not -receive a response from the client, then the connection is considered idle -and terminated. - -To ensure the SSH idle timeout occurs precisely when the -ClientAliveInterval is set, set the ClientAliveCountMax to -value of 0 in - - -/etc/ssh/sshd_config: - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 7 - 8 - 5.5.6 - APO13.01 - BAI03.01 - BAI03.02 - BAI03.03 - DSS01.03 - DSS03.05 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.1.11 - CCI-000879 - CCI-001133 - CCI-002361 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 6.2 - A.12.4.1 - A.12.4.3 - A.14.1.1 - A.14.2.1 - A.14.2.5 - A.18.1.4 - A.6.1.2 - A.6.1.5 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-2(5) - AC-12 - AC-17(a) - SC-10 - CM-6(a) - DE.CM-1 - DE.CM-3 - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.IP-2 - Req-8.1.8 - SRG-OS-000126-GPOS-00066 - SRG-OS-000163-GPOS-00072 - SRG-OS-000279-GPOS-00109 - SRG-OS-000480-VMM-002000 - This ensures a user login will be terminated as soon as the ClientAliveInterval -is reached. - - - CCE-83406-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Set SSH Client Alive Count Max - The SSH server sends at most ClientAliveCountMax messages -during a SSH session and waits for a response from the SSH client. -The option ClientAliveInterval configures timeout after -each ClientAliveCountMax message. If the SSH server does not -receive a response from the client, then the connection is considered idle -and terminated. -For SSH earlier than v8.2, a ClientAliveCountMax value of 0 -causes an idle timeout precisely when the ClientAliveInterval is set. -Starting with v8.2, a value of 0 disables the timeout functionality -completely. If the option is set to a number greater than 0, then -the idle session will be disconnected after -ClientAliveInterval * ClientAliveCountMax seconds. - BP28(R29) - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 7 - 8 - 5.5.6 - APO13.01 - BAI03.01 - BAI03.02 - BAI03.03 - DSS01.03 - DSS03.05 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.1.11 - CCI-000879 - CCI-001133 - CCI-002361 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 6.2 - A.12.4.1 - A.12.4.3 - A.14.1.1 - A.14.2.1 - A.14.2.5 - A.18.1.4 - A.6.1.2 - A.6.1.5 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-2(5) - AC-12 - AC-17(a) - SC-10 - CM-6(a) - DE.CM-1 - DE.CM-3 - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.IP-2 - Req-8.1.8 - SRG-OS-000163-GPOS-00072 - SRG-OS-000279-GPOS-00109 - SRG-OS-000480-VMM-002000 - This ensures a user login will be terminated as soon as the ClientAliveInterval -is reached. - - - CCE-82464-9 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - - Set SSH Idle Timeout Interval - SSH allows administrators to set an idle timeout interval. After this interval -has passed, the idle user will be automatically logged out. - -To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as -follows: -ClientAliveInterval - -The timeout interval is given in seconds. For example, have a timeout -of 10 minutes, set interval to 600. - -If a shorter timeout has already been set for the login shell, that value will -preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that -some processes may stop SSH from correctly detecting that the user is idle. - SSH disconnecting idle clients will not have desired effect without also -configuring ClientAliveCountMax in the SSH service configuration. - Following conditions may prevent the SSH session to time out: -Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.Any scp or sftp activity by the same user to the host resets the timeout. - BP28(R29) - 1 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 7 - 8 - 5.5.6 - APO13.01 - BAI03.01 - BAI03.02 - BAI03.03 - DSS01.03 - DSS03.05 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.1.11 - CCI-000879 - CCI-001133 - CCI-002361 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 6.2 - A.12.4.1 - A.12.4.3 - A.14.1.1 - A.14.2.1 - A.14.2.5 - A.18.1.4 - A.6.1.2 - A.6.1.5 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-004-6 R2.2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - CM-6(a) - AC-17(a) - AC-2(5) - AC-12 - AC-17(a) - SC-10 - CM-6(a) - DE.CM-1 - DE.CM-3 - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.IP-2 - Req-8.1.8 - SRG-OS-000126-GPOS-00066 - SRG-OS-000163-GPOS-00072 - SRG-OS-000279-GPOS-00109 - SRG-OS-000395-GPOS-00175 - SRG-OS-000480-VMM-002000 - Terminating an idle ssh session within a short time period reduces the window of -opportunity for unauthorized personnel to take control of a management session -enabled on the console or console port that has been let unattended. - - - CCE-82549-7 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - - - Disable Host-Based Authentication - SSH's cryptographic host-based authentication is -more secure than .rhosts authentication. However, it is -not recommended that hosts unilaterally trust one another, even -within an organization. - -The default SSH configuration disables host-based authentication. The appropriate -configuration is used if no value is set for HostbasedAuthentication. - -To explicitly disable host-based authentication, add or correct the -following line in - - -/etc/ssh/sshd_config: - -HostbasedAuthentication no - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - 9 - 5.5.6 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - DSS06.06 - 3.1.12 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - 0421 - 0422 - 0431 - 0974 - 1173 - 1401 - 1504 - 1505 - 1546 - 1557 - 1558 - 1559 - 1560 - 1561 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-3 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.IP-1 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000480-GPOS-00229 - SRG-OS-000480-VMM-002000 - SSH trust relationships mean a compromise on one host -can allow an attacker to move trivially to other hosts. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018%2F04%2F09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D%2Fusr%2Flocal%2Fbin%3A%2Fusr%2Fbin%3A%2Fusr%2Flocal%2Fsbin%3A%2Fusr%2Fsbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_rsa_key%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_ecdsa_key%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20512M%201h%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20%2Fetc%2Fsysconfig%2Fsshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%202m%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh%2Fauthorized_keys%20and%20.ssh%2Fauthorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh%2Fauthorized_keys%0AAuthorizedKeysFile%09.ssh%2Fauthorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20%2Fetc%2Fssh%2Fssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~%2F.ssh%2Fknown_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~%2F.rhosts%20and%20~%2F.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s%2Fkey%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20%2Fetc%2Fpam.d%2Fsshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20no%0AClientAliveInterval%20600%0AClientAliveCountMax%200%0A%23UseDNS%20no%0A%23PidFile%20%2Fvar%2Frun%2Fsshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20%2Fetc%2Fissue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09%2Fusr%2Flibexec%2Fopenssh%2Fsftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20sandbox - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Allow Only SSH Protocol 2 - Only SSH protocol version 2 connections should be -permitted. The default setting in -/etc/ssh/sshd_config is correct, and can be -verified by ensuring that the following -line appears: -Protocol 2 - As of openssh-server version 7.4 and above, the only protocol -supported is version 2, and line Protocol 2 in -/etc/ssh/sshd_config is not necessary. - NT007(R1) - 1 - 12 - 15 - 16 - 5 - 8 - 5.5.6 - APO13.01 - DSS01.04 - DSS05.02 - DSS05.03 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - 3.1.13 - 3.5.4 - CCI-000197 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.6 - SR 3.1 - SR 3.5 - SR 3.8 - SR 4.1 - SR 4.3 - SR 5.1 - SR 5.2 - SR 5.3 - SR 7.1 - SR 7.6 - 0487 - 1449 - 1506 - A.11.2.6 - A.13.1.1 - A.13.2.1 - A.14.1.3 - A.18.1.4 - A.6.2.1 - A.6.2.2 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CIP-003-8 R4.2 - CIP-007-3 R5.1 - CIP-007-3 R7.1 - CM-6(a) - AC-17(a) - AC-17(2) - IA-5(1)(c) - SC-13 - MA-4(6) - PR.AC-1 - PR.AC-3 - PR.AC-6 - PR.AC-7 - PR.PT-4 - SRG-OS-000074-GPOS-00042 - SRG-OS-000480-GPOS-00227 - SRG-OS-000033-VMM-000140 - SSH protocol version 1 is an insecure implementation of the SSH protocol and -has many well-known vulnerability exploits. Exploits of the SSH daemon could provide -immediate root access to the system. - - - - - - - - - - - Disable Compression Or Set Compression to delayed - Compression is useful for slow network connections over long -distances but can cause performance issues on local LANs. If use of compression -is required, it should be enabled only after a user has authenticated; otherwise, -it should be disabled. To disable compression or delay compression until after -a user has successfully authenticated, add or correct the following line in the -/etc/ssh/sshd_config file: -Compression - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - 3.1.12 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-VMM-002000 - If compression is allowed in an SSH connection prior to authentication, -vulnerabilities in the compression software could result in compromise of the -system from an unauthenticated connection, potentially with root privileges. - - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - - Disable SSH Access via Empty Passwords - Disallow SSH login with empty passwords. -The default SSH configuration disables logins with empty passwords. The appropriate -configuration is used if no value is set for PermitEmptyPasswords. - -To explicitly disallow SSH login from accounts with empty passwords, -add or correct the following line in - - -/etc/ssh/sshd_config: - - -PermitEmptyPasswords no -Any accounts with empty passwords should be disabled immediately, and PAM configuration -should prevent users from being able to assign themselves empty passwords. - NT007(R17) - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 9 - 5.5.6 - APO01.06 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.02 - DSS06.03 - DSS06.06 - 3.1.1 - 3.1.5 - CCI-000366 - CCI-000766 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 5.2 - SR 7.6 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.DS-5 - PR.IP-1 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000106-GPOS-00053 - SRG-OS-000480-GPOS-00229 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-VMM-002000 - Configuring this setting for the SSH daemon provides additional assurance -that remote login via SSH will require a password, even in the event of -misconfiguration elsewhere. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable GSSAPI Authentication - Unless needed, SSH should not permit extraneous or unnecessary -authentication mechanisms like GSSAPI. - -The default SSH configuration disallows authentications based on GSSAPI. The appropriate -configuration is used if no value is set for GSSAPIAuthentication. - -To explicitly disable GSSAPI authentication, add or correct the following line in - - -/etc/ssh/sshd_config: - -GSSAPIAuthentication no - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - 3.1.12 - CCI-000318 - CCI-000368 - CCI-001812 - CCI-001813 - CCI-001814 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - 0418 - 1055 - 1402 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - CM-7(a) - CM-7(b) - CM-6(a) - AC-17(a) - PR.IP-1 - FTP_ITC_EXT.1 - FCS_SSH_EXT.1.2 - SRG-OS-000364-GPOS-00151 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-VMM-002000 - GSSAPI authentication is used to provide additional authentication mechanisms to -applications. Allowing GSSAPI authentication through SSH exposes the system's -GSSAPI to remote hosts, increasing the attack surface of the system. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable Kerberos Authentication - Unless needed, SSH should not permit extraneous or unnecessary -authentication mechanisms like Kerberos. - -The default SSH configuration disallows authentication validation through Kerberos. -The appropriate configuration is used if no value is set for KerberosAuthentication. - -To explicitly disable Kerberos authentication, add or correct the following line in - - -/etc/ssh/sshd_config: - -KerberosAuthentication no - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - 3.1.12 - CCI-000318 - CCI-000368 - CCI-001812 - CCI-001813 - CCI-001814 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - 0421 - 0422 - 0431 - 0974 - 1173 - 1401 - 1504 - 1505 - 1546 - 1557 - 1558 - 1559 - 1560 - 1561 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - FTP_ITC_EXT.1 - FCS_SSH_EXT.1.2 - SRG-OS-000364-GPOS-00151 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-VMM-002000 - Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos -is enabled through SSH, the SSH daemon provides a means of access to the -system's Kerberos implementation. -Configuring these settings for the SSH daemon provides additional assurance that remote logon via SSH will not use unused methods of authentication, even in the event of misconfiguration elsewhere. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable PubkeyAuthentication Authentication - Unless needed, SSH should not permit extraneous or unnecessary -authentication mechanisms. To disable PubkeyAuthentication authentication, add or -correct the following line in - - -/etc/ssh/sshd_config: - -PubkeyAuthentication no - PubkeyAuthentication authentication is used to provide additional authentication mechanisms to -applications. Allowing PubkeyAuthentication authentication through SSH allows users to -generate their own authentication tokens, increasing the attack surface of the system. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable SSH Support for .rhosts Files - SSH can emulate the behavior of the obsolete rsh -command in allowing users to enable insecure access to their -accounts via .rhosts files. - -The default SSH configuration disables support for .rhosts. The appropriate -configuration is used if no value is set for IgnoreRhosts. - -To explicitly disable support for .rhosts files, add or correct the following line in - - -/etc/ssh/sshd_config: - -IgnoreRhosts yes - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - 9 - 5.5.6 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - DSS06.06 - 3.1.12 - CCI-000366 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - 4.3.4.3.2 - 4.3.4.3.3 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.IP-1 - PR.PT-3 - FIA_UAU.1 - SRG-OS-000480-GPOS-00227 - SRG-OS-000107-VMM-000530 - SSH trust relationships mean a compromise on one host -can allow an attacker to move trivially to other hosts. - - CCE-82665-1 - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable SSH Support for Rhosts RSA Authentication - SSH can allow authentication through the obsolete rsh -command through the use of the authenticating user's SSH keys. This should be disabled. - -To ensure this behavior is disabled, add or correct the -following line in /etc/ssh/sshd_config: -RhostsRSAAuthentication no - As of openssh-server version 7.4 and above, -the RhostsRSAAuthentication option has been deprecated, and the line -RhostsRSAAuthentication no in /etc/ssh/sshd_config is not -necessary. - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - 3.1.12 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - FIA_UAU.1 - SRG-OS-000480-GPOS-00227 - Configuring this setting for the SSH daemon provides additional -assurance that remote login via SSH will require a password, even -in the event of misconfiguration elsewhere. - - - - - - - - - - - Disable SSH Root Login - The root user should never be allowed to login to a -system directly over a network. -To disable root login via SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -PermitRootLogin no - BP28(R19) - NT007(R21) - 1 - 11 - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - 5.5.6 - APO01.06 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.02 - DSS06.03 - DSS06.06 - DSS06.10 - 3.1.1 - 3.1.5 - CCI-000366 - CCI-000770 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.18.1.4 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.1 - A.9.4.2 - A.9.4.3 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-6(2) - AC-17(a) - IA-2 - IA-2(5) - CM-7(a) - CM-7(b) - CM-6(a) - PR.AC-1 - PR.AC-4 - PR.AC-6 - PR.AC-7 - PR.DS-5 - PR.PT-3 - FAU_GEN.1 - SRG-OS-000109-GPOS-00056 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-VMM-002000 - Even though the communications channel may be encrypted, an additional layer of -security is gained by extending the policy of not logging directly on as root. -In addition, logging in with a user-specific account provides individual -accountability of actions performed on the system and also helps to minimize -direct attack attempts on root's password. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable SSH root Login with a Password (Insecure) - To disable password-based root logins over SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -PermitRootLogin prohibit-password - While this disables password-based root logins, direct root logins -through other means such as through SSH keys or GSSAPI will still be -permitted. Permitting any sort of root login remotely opens up the -root account to attack. -To fully disable direct root logins over SSH (which is considered a -best practice) and prevent remote attacks against the root account, -see CCE-27100-7, CCE-27445-6, CCE-80901-2, and similar. - Even though the communications channel may be encrypted, an additional -layer of security is gained by preventing use of a password. -This also helps to minimize direct attack attempts on root's password. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable SSH TCP Forwarding - The AllowTcpForwarding parameter specifies whether TCP forwarding is permitted. -To disable TCP forwarding, add or correct the following line in - - -/etc/ssh/sshd_config: - -AllowTcpForwarding no - Leaving port forwarding enabled can expose the organization to security risks and back-doors. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable SSH Support for User Known Hosts - SSH can allow system users to connect to systems if a cache of the remote -systems public keys is available. This should be disabled. - -To ensure this behavior is disabled, add or correct the following line in - - -/etc/ssh/sshd_config: - -IgnoreUserKnownHosts yes - 11 - 3 - 9 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - 3.1.12 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - FIA_UAU.1 - SRG-OS-000480-GPOS-00227 - Configuring this setting for the SSH daemon provides additional -assurance that remote login via SSH will require a password, even -in the event of misconfiguration elsewhere. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Disable X11 Forwarding - The X11Forwarding parameter provides the ability to tunnel X11 traffic -through the connection to enable remote graphic connections. -SSH has the capability to encrypt remote X11 connections when SSH's -X11Forwarding option is enabled. - -The default SSH configuration disables X11Forwarding. The appropriate -configuration is used if no value is set for X11Forwarding. - -To explicitly disable X11 Forwarding, add or correct the following line in - - -/etc/ssh/sshd_config: - -X11Forwarding no - CCI-000366 - CM-6(b) - SRG-OS-000480-GPOS-00227 - Disable X11 forwarding unless there is an operational requirement to use X11 -applications directly. There is a small risk that the remote X11 servers of -users who are logged in via SSH with X11 forwarding could be compromised by -other users on the X11 server. Note that even if X11 forwarding is disabled, -users can always install their own forwarders. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Do Not Allow SSH Environment Options - Ensure that users are not able to override environment variables of the SSH daemon. - -The default SSH configuration disables environment processing. The appropriate -configuration is used if no value is set for PermitUserEnvironment. - -To explicitly disable Environment options, add or correct the following - - -/etc/ssh/sshd_config: - -PermitUserEnvironment no - 11 - 3 - 9 - 5.5.6 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - 3.1.12 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.4.3.2 - 4.3.4.3.3 - SR 7.6 - A.12.1.2 - A.12.5.1 - A.12.6.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - AC-17(a) - CM-7(a) - CM-7(b) - CM-6(a) - PR.IP-1 - SRG-OS-000480-GPOS-00229 - SRG-OS-000480-VMM-002000 - SSH environment options potentially allow users to bypass -access restriction in some configurations. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Enable GSSAPI Authentication - Sites setup to use Kerberos or other GSSAPI Authenticaion require setting -sshd to accept this authentication. -To enable GSSAPI authentication, add or correct the following line in - - -/etc/ssh/sshd_config: - -GSSAPIAuthentication yes - Kerberos authentication for SSH is often implemented using GSSAPI. If -Kerberos is enabled through SSH, the SSH daemon provides a means of access -to the system's Kerberos implementation. Vulnerabilities in the system's -Kerberos implementations may be subject to exploitation. - -For enterprises, Kerberos is often enabled and used with GSSAPI for -centralized user account management which may necessitate enabling of -GSSAPI functionality in SSH. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Enable PAM - UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will -enable PAM authentication using ChallengeResponseAuthentication and -PasswordAuthentication in addition to PAM account and session module processing for all -authentication types. - -To enable PAM authentication, add or correct the following line in - - -/etc/ssh/sshd_config: - -UsePAM yes - CCI-000877 - SRG-OS-000125-GPOS-00065 - When UsePAM is set to yes, PAM runs through account and session types properly. This is -important if you want to restrict access to services based off of IP, time or other factors of -the account. Additionally, you can make sure users inherit certain environment variables -on login or disallow access to the server. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Enable Public Key Authentication - Enable SSH login with public keys. - -The default SSH configuration enables authentication based on public keys. The appropriate -configuration is used if no value is set for PubkeyAuthentication. - -To explicitly enable Public Key Authentication, add or correct the following - - -/etc/ssh/sshd_config: - -PubkeyAuthentication yes - CCI-000765 - CCI-000766 - CCI-000767 - CCI-000768 - SRG-OS-000105-GPOS-00052 - SRG-OS-000106-GPOS-00053 - SRG-OS-000107-GPOS-00054 - SRG-OS-000108-GPOS-00055 - Without the use of multifactor authentication, the ease of access to -privileged functions is greatly increased. Multifactor authentication -requires using two or more factors to achieve authentication. -A privileged account is defined as an information system account with -authorizations of a privileged user. -The DoD CAC with DoD-approved PKI is an example of multifactor -authentication. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Enable Use of Strict Mode Checking - SSHs StrictModes option checks file and ownership permissions in -the user's home directory .ssh folder before accepting login. If world- -writable permissions are found, logon is rejected. - -The default SSH configuration has StrictModes enabled. The appropriate -configuration is used if no value is set for StrictModes. - -To explicitly enable StrictModes in SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -StrictModes yes - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.12 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - AC-6 - AC-17(a) - CM-6(a) - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - SRG-OS-000480-VMM-002000 - If other users have access to modify user-specific SSH configuration files, they -may be able to log into the system as another user. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Enable SSH Warning Banner - To enable the warning banner and ensure it is consistent -across the system, add or correct the following line in - - -/etc/ssh/sshd_config: - -Banner /etc/issue -Another section contains information on how to create an -appropriate system-wide warning banner. - 1 - 12 - 15 - 16 - 5.5.6 - DSS05.04 - DSS05.10 - DSS06.10 - 3.1.9 - CCI-000048 - CCI-000050 - CCI-001384 - CCI-001385 - CCI-001386 - CCI-001387 - CCI-001388 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.4 - A.9.3.1 - A.9.4.2 - A.9.4.3 - AC-8(a) - AC-8(c) - AC-17(a) - CM-6(a) - PR.AC-7 - FTA_TAB.1 - SRG-OS-000023-GPOS-00006 - SRG-OS-000228-GPOS-00088 - SRG-OS-000023-VMM-000060 - SRG-OS-000024-VMM-000070 - The warning message reinforces policy awareness during the logon process and -facilitates possible legal action against attackers. Alternatively, systems -whose ownership should not be obvious should ensure usage of a banner that does -not provide easy attribution. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Enable SSH Warning Banner - To enable the warning banner and ensure it is consistent -across the system, add or correct the following line in - -/etc/ssh/sshd_config: - -Banner /etc/issue.net -Another section contains information on how to create an -appropriate system-wide warning banner. - 5.5.6 - DSS05.04 - DSS05.10 - DSS06.10 - 3.1.9 - CCI-000048 - CCI-000050 - CCI-001384 - CCI-001385 - CCI-001386 - CCI-001387 - CCI-001388 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.4 - A.9.3.1 - A.9.4.2 - A.9.4.3 - AC-8(a) - AC-8(c) - AC-17(a) - CM-6(a) - PR.AC-7 - FTA_TAB.1 - SRG-OS-000023-GPOS-00006 - SRG-OS-000228-GPOS-00088 - SRG-OS-000023-VMM-000060 - SRG-OS-000024-VMM-000070 - The warning message reinforces policy awareness during the logon process and -facilitates possible legal action against attackers. Alternatively, systems -whose ownership should not be obvious should ensure usage of a banner that does -not provide easy attribution. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Enable Encrypted X11 Forwarding - By default, remote X11 connections are not encrypted when initiated -by users. SSH has the capability to encrypt remote X11 connections when SSH's -X11Forwarding option is enabled. - -To enable X11 Forwarding, add or correct the following line in - - -/etc/ssh/sshd_config: - -X11Forwarding yes - 1 - 11 - 12 - 13 - 15 - 16 - 18 - 20 - 3 - 4 - 6 - 9 - BAI03.08 - BAI07.04 - BAI10.01 - BAI10.02 - BAI10.03 - BAI10.05 - DSS03.01 - 3.1.13 - CCI-000366 - 4.3.4.3.2 - 4.3.4.3.3 - 4.4.3.3 - SR 7.6 - A.12.1.1 - A.12.1.2 - A.12.1.4 - A.12.5.1 - A.12.6.2 - A.13.1.1 - A.13.1.2 - A.14.2.2 - A.14.2.3 - A.14.2.4 - CIP-007-3 R7.1 - CM-6(a) - AC-17(a) - AC-17(2) - DE.AE-1 - PR.DS-7 - PR.IP-1 - SRG-OS-000480-GPOS-00227 - Non-encrypted X displays allow an attacker to capture keystrokes and to execute commands -remotely. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Limit Users' SSH Access - By default, the SSH configuration allows any user with an account -to access the system. In order to specify the users that are allowed to login -via SSH and deny all other users, add or correct the following line in the -/etc/ssh/sshd_config file: -AllowUsers USER1 USER2 -Where USER1 and USER2 are valid user names. - 11 - 12 - 14 - 15 - 16 - 18 - 3 - 5 - DSS05.02 - DSS05.04 - DSS05.05 - DSS05.07 - DSS06.03 - DSS06.06 - 3.1.12 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.5.3 - 4.3.3.5.4 - 4.3.3.5.5 - 4.3.3.5.6 - 4.3.3.5.7 - 4.3.3.5.8 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.1 - 4.3.3.7.2 - 4.3.3.7.3 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.11 - SR 1.12 - SR 1.13 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.6 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - SR 2.2 - SR 2.3 - SR 2.4 - SR 2.5 - SR 2.6 - SR 2.7 - A.6.1.2 - A.7.1.1 - A.9.1.2 - A.9.2.1 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.2.3 - CIP-004-6 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.2 - CIP-007-3 R5.2 - CIP-007-3 R5.3.1 - CIP-007-3 R5.3.2 - CIP-007-3 R5.3.3 - AC-3 - CM-6(a) - PR.AC-4 - PR.AC-6 - PR.PT-3 - Specifying which accounts are allowed SSH access into the system reduces the -possibility of unauthorized access to the system. - - CCE-82664-4 - - - - - - Enable SSH Print Last Log - Ensure that SSH will display the date and time of the last successful account logon. - -The default SSH configuration enables print of the date and time of the last login. -The appropriate configuration is used if no value is set for PrintLastLog. - -To explicitly enable LastLog in SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -PrintLastLog yes - 1 - 12 - 15 - 16 - DSS05.04 - DSS05.10 - DSS06.10 - CCI-000366 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - A.18.1.4 - A.9.2.1 - A.9.2.4 - A.9.3.1 - A.9.4.2 - A.9.4.3 - AC-9 - AC-17(a) - CM-6(a) - PR.AC-7 - SRG-OS-000480-GPOS-00227 - Providing users feedback on when account accesses last occurred facilitates user -recognition and reporting of unauthorized account use. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Force frequent session key renegotiation - The RekeyLimit parameter specifies how often -the session key of the is renegotiated, both in terms of -amount of data that may be transmitted and the time -elapsed. -To decrease the default limits, add or correct the following line in - - -/etc/ssh/sshd_config: - -RekeyLimit - CCI-000068 - FCS_SSH_EXT.1.8 - SRG-OS-000480-GPOS-00227 - SRG-OS-000033-GPOS-00014 - By decreasing the limit based on the amount of data and enabling -time-based limit, effects of potential attacks against -encryption keys are limited. - - - - - - - - - - - - - Ensure SSH LoginGraceTime is configured - The LoginGraceTime parameter to the SSH server specifies the time allowed for successful authentication to -the SSH server. The longer the Grace period is the more open unauthenticated connections -can exist. Like other session controls in this session the Grace Period should be limited to -appropriate limits to ensure the service is available for needed access. - Setting the LoginGraceTime parameter to a low number will minimize the risk of successful -brute force attacks to the SSH server. It will also limit the number of concurrent -unauthenticated connections. - - - - - - - - - - - - Set LogLevel to INFO - The INFO parameter specifices that record login and logout activity will be logged. - -The default SSH configuration sets the log level to INFO. The appropriate -configuration is used if no value is set for LogLevel. - -To explicitly specify the log level in SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -LogLevel INFO - AC-17(a) - CM-6(a) - SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically -not recommended other than strictly for debugging SSH communications since it provides -so much data that it is difficult to identify important security information. INFO level is the -basic level that only records login activity of SSH users. In many situations, such as Incident -Response, it is important to determine when a particular user was active on a system. The -logout record can eliminate those users who disconnected, which helps narrow the field. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Set SSH Daemon LogLevel to VERBOSE - The VERBOSE parameter configures the SSH daemon to record login and logout activity. -To specify the log level in -SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -LogLevel VERBOSE - CCI-000067 - CIP-007-3 R7.1 - AC-17(a) - AC-17(1) - CM-6(a) - SRG-OS-000032-GPOS-00013 - SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically -not recommended other than strictly for debugging SSH communications since it provides -so much data that it is difficult to identify important security information. INFO or -VERBOSE level is the basic level that only records login activity of SSH users. In many -situations, such as Incident Response, it is important to determine when a particular user was active -on a system. The logout record can eliminate those users who disconnected, which helps narrow the -field. - - apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018/04/09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D/usr/local/bin%3A/usr/bin%3A/usr/local/sbin%3A/usr/sbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20/etc/ssh/ssh_host_rsa_key%0AHostKey%20/etc/ssh/ssh_host_ecdsa_key%0AHostKey%20/etc/ssh/ssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20%7B%7B.var_rekey_limit_size%7D%7D%20%7B%7B.var_rekey_limit_time%7D%7D%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20/etc/sysconfig/sshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%20%7B%7B.var_sshd_set_login_grace_time%7D%7D%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh/authorized_keys%20and%20.ssh/authorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh/authorized_keys%0AAuthorizedKeysFile%09.ssh/authorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20/etc/ssh/ssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~/.ssh/known_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~/.rhosts%20and%20~/.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s/key%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20/etc/pam.d/sshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20%7B%7B.var_sshd_disable_compression%7D%7D%0AClientAliveInterval%20%7B%7B.sshd_idle_timeout_value%7D%7D%0AClientAliveCountMax%20%7B%7B.var_sshd_set_keepalive%7D%7D%0A%23UseDNS%20no%0A%23PidFile%20/var/run/sshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20/etc/issue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09/usr/libexec/openssh/sftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20%7B%7B.var_sshd_priv_separation%7D%7D }} - mode: 0600 - path: /etc/ssh/sshd_config - overwrite: true - - - - - - - - - - - Set SSH authentication attempt limit - The MaxAuthTries parameter specifies the maximum number of authentication attempts -permitted per connection. Once the number of failures reaches half this value, additional failures are logged. -to set MaxAUthTries edit /etc/ssh/sshd_config as follows: -MaxAuthTries - 0421 - 0422 - 0431 - 0974 - 1173 - 1401 - 1504 - 1505 - 1546 - 1557 - 1558 - 1559 - 1560 - 1561 - Setting the MaxAuthTries parameter to a low number will minimize the risk of successful -brute force attacks to the SSH server. - - - - - - - - - - - Set SSH MaxSessions limit - The MaxSessions parameter specifies the maximum number of open sessions permitted -from a given connection. To set MaxSessions edit -/etc/ssh/sshd_config as follows: MaxSessions - To protect a system from denial of service due to a large number of concurrent -sessions, use the rate limiting function of MaxSessions to protect availability -of sshd logins and prevent overwhelming the daemon. - - - - - - - - - - - - Ensure SSH MaxStartups is configured - The MaxStartups parameter specifies the maximum number of concurrent -unauthenticated connections to the SSH daemon. Additional connections will be -dropped until authentication succeeds or the LoginGraceTime expires for a -connection. To confgure MaxStartups, you should add or correct the following -line in the -/etc/ssh/sshd_config file: -MaxStartups -CIS recommends a MaxStartups value of '10:30:60', or more restrictive where -dictated by site policy. - To protect a system from denial of service due to a large number of pending -authentication connection attempts, use the rate limiting function of MaxStartups -to protect availability of sshd logins and prevent overwhelming the daemon. - - - - - - - - - - - Enable Use of Privilege Separation - When enabled, SSH will create an unprivileged child process that -has the privilege of the authenticated user. To enable privilege separation in -SSH, add or correct the following line in the /etc/ssh/sshd_config file: -UsePrivilegeSeparation - 12 - 13 - 14 - 15 - 16 - 18 - 3 - 5 - APO01.06 - DSS05.04 - DSS05.07 - DSS06.02 - 3.1.12 - CCI-000366 - 164.308(a)(4)(i) - 164.308(b)(1) - 164.308(b)(3) - 164.310(b) - 164.312(e)(1) - 164.312(e)(2)(ii) - 4.3.3.7.3 - SR 2.1 - SR 5.2 - A.10.1.1 - A.11.1.4 - A.11.1.5 - A.11.2.1 - A.13.1.1 - A.13.1.3 - A.13.2.1 - A.13.2.3 - A.13.2.4 - A.14.1.2 - A.14.1.3 - A.6.1.2 - A.7.1.1 - A.7.1.2 - A.7.3.1 - A.8.2.2 - A.8.2.3 - A.9.1.1 - A.9.1.2 - A.9.2.3 - A.9.4.1 - A.9.4.4 - A.9.4.5 - CIP-003-8 R5.1.1 - CIP-003-8 R5.3 - CIP-004-6 R2.3 - CIP-007-3 R2.1 - CIP-007-3 R2.2 - CIP-007-3 R2.3 - CIP-007-3 R5.1 - CIP-007-3 R5.1.1 - CIP-007-3 R5.1.2 - CM-6(a) - AC-17(a) - AC-6 - PR.AC-4 - PR.DS-5 - SRG-OS-000480-GPOS-00227 - SSH daemon privilege separation causes the SSH process to drop root privileges -when not needed which would decrease the impact of software vulnerabilities in -the unprivileged section. - - - - - - - - - - - - Strengthen Firewall Configuration if Possible - If the SSH server is expected to only receive connections from -the local network, then strengthen the default firewall rule for the SSH service -to only accept connections from the appropriate network segment(s). - -Determine an appropriate network block, netwk, network mask, mask, and -network protocol, ip_protocol, representing the systems on your network which will -be allowed to access this SSH server. - -Run the following command: -firewall-cmd --permanent --add-rich-rule='rule family="ip_protocol" source address="netwk/mask" service name="ssh" accept' - - - - - - System Security Services Daemon - The System Security Services Daemon (SSSD) is a system daemon that provides access -to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD, -openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline -support to systems utilizing SSSD. SSSD using caching to reduce load on authentication -servers permit offline authentication as well as store extended user data. - -For more information, see - - - SSSD certificate_verification option - Value of the certificate_verification option in -the SSSD config. - sha1 - sha256 - sha384 - sha512 - sha1 - - - SSSD memcache_timeout option - Value of the memcache_timeout option in the [nss] section -of SSSD config /etc/sssd/sssd.conf. - 180 - 300 - 600 - 900 - 1800 - 86400 - 300 - - - SSSD ssh_known_hosts_timeout option - Value of the ssh_known_hosts_timeout option in the [ssh] section -of SSSD configuration file /etc/sssd/sssd.conf. - 180 - 300 - 600 - 900 - 1800 - 86400 - 180 - - - Enable Smartcards in SSSD - SSSD should be configured to authenticate access to the system using smart cards. -To enable smart cards in SSSD, set pam_cert_auth to True under the -[pam] section in /etc/sssd/sssd.conf. For example: -[pam] -pam_cert_auth = True - - CCI-001954 - CCI-000765 - CCI-000766 - CCI-000767 - CCI-000768 - 0421 - 0422 - 0431 - 0974 - 1173 - 1401 - 1504 - 1505 - 1546 - 1557 - 1558 - 1559 - 1560 - 1561 - SRG-OS-000375-GPOS-00160 - SRG-OS-000105-GPOS-00052 - SRG-OS-000106-GPOS-00053 - SRG-OS-000107-GPOS-00054 - SRG-OS-000108-GPOS-00055 - SRG-OS-000107-VMM-000530 - Using an authentication device, such as a CAC or token that is separate from -the information system, ensures that even if the information system is -compromised, that compromise will not affect credentials stored on the -authentication device. - -Multi-Factor Authentication (MFA) solutions that require devices separate from -information systems gaining access include, for example, hardware tokens -providing time-based or challenge-response authenticators and smart cards such -as the U.S. Government Personal Identity Verification card and the DoD Common -Access Card. - - - - - - - - - - Configure SSSD to Expire Offline Credentials - SSSD should be configured to expire offline credentials after 1 day. - -To configure SSSD to expire offline credentials, set -offline_credentials_expiration to 1 under the [pam] -section in /etc/sssd/sssd.conf. For example: -[pam] -offline_credentials_expiration = 1 - - 1 - 12 - 15 - 16 - 5 - DSS05.04 - DSS05.05 - DSS05.07 - DSS05.10 - DSS06.03 - DSS06.10 - CCI-002007 - 4.3.3.2.2 - 4.3.3.5.1 - 4.3.3.5.2 - 4.3.3.6.1 - 4.3.3.6.2 - 4.3.3.6.3 - 4.3.3.6.4 - 4.3.3.6.5 - 4.3.3.6.6 - 4.3.3.6.7 - 4.3.3.6.8 - 4.3.3.6.9 - 4.3.3.7.2 - 4.3.3.7.4 - SR 1.1 - SR 1.10 - SR 1.2 - SR 1.3 - SR 1.4 - SR 1.5 - SR 1.7 - SR 1.8 - SR 1.9 - SR 2.1 - A.18.1.4 - A.7.1.1 - A.9.2.1 - A.9.2.2 - A.9.2.3 - A.9.2.4 - A.9.2.6 - A.9.3.1 - A.9.4.2 - A.9.4.3 - CM-6(a) - IA-5(13) - PR.AC-1 - PR.AC-6 - PR.AC-7 - SRG-OS-000383-GPOS-00166 - SRG-OS-000383-VMM-001570 - If cached authentication information is out-of-date, the validity of the -authentication information may be questionable. - - - - - - - - - - Configure SSSD to run as user sssd - SSSD processes should be configured to run as user sssd, not root. - FMT_SMF_EXT.1 - SRG-OS-000480-GPOS-00227 - To minimize privileges of SSSD processes, they are configured to -run as non-root user. - - CCE-82536-4 - - - - - - - - - System Security Services Daemon (SSSD) - LDAP - The System Security Services Daemon (SSSD) is a system daemon that provides access -to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD, -openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline -support to systems utilizing SSSD. SSSD using caching to reduce load on authentication -servers permit offline authentication as well as store extended user data. - -SSSD can support many backends including LDAP. The sssd-ldap backend -allows SSSD to fetch identity information from an LDAP server. - - - SSSD LDAP Backend Client CA Certificate Location - Path of a directory that contains Certificate Authority certificates. - /etc/openldap/cacerts - - - - - USBGuard daemon - The USBGuard daemon enforces the USB device authorization policy for all USB devices. - - - Install usbguard Package - -The usbguard package can be installed with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-usbguard-install -spec: - config: - ignition: - version: 3.1.0 - extensions: - - usbguard - - -This will install the usbguard package in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - CCI-001958 - 1418 - CM-8(3) - IA-3 - SRG-OS-000378-GPOS-00163 - usbguard is a software framework that helps to protect -against rogue USB devices by implementing basic whitelisting/blacklisting -capabilities based on USB device attributes. - - CCE-82524-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -spec: - config: - ignition: - version: 3.1.0 - extensions: - - usbguard - - - - - - - - - - Enable the USBGuard Service - The USBGuard service should be enabled. - -The usbguard service can be enabled with the following manifest: - ---- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - labels: - machineconfiguration.openshift.io/role: master - name: 75-master-usbguard-enable -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: usbguard.service - enabled: true - - -This will enable the usbguard service in all the -nodes labeled with the "master" role. - - -Note that this needs to be done for each MachineConfigPool - - -For more information on how to configure nodes with the Machine Config -Operator see -the relevant documentation. - - CCI-000416 - CCI-001958 - 1418 - CM-8(3)(a) - IA-3 - FMT_SMF_EXT.1 - SRG-OS-000378-GPOS-00163 - The usbguard service must be running in order to -enforce the USB device authorization policy for all USB devices. - - CCE-82537-2 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - annotations: - complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed -spec: - config: - ignition: - version: 3.1.0 - systemd: - units: - - name: usbguard.service - enabled: true - - - - - - - - - - Log USBGuard daemon audit events using Linux Audit - To configure USBGuard daemon to log via Linux Audit -(as opposed directly to a file), -AuditBackend option in /etc/usbguard/usbguard-daemon.conf -needs to be set to LinuxAudit. - CCI-000169 - CCI-000172 - AU-2 - CM-8(3) - IA-3 - FMT_SMF_EXT.1 - SRG-OS-000062-GPOS-00031 - SRG-OS-000471-GPOS-00215 - Using the Linux Audit logging allows for centralized trace -of events. - - CCE-82538-0 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - annotations: - complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed - complianceascode.io/ocp-version: '>=4.7.0' -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0A%23%0A%23%20Rule%20set%20file%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20file%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%0A%23%0A%23%20RuleFile%3D/path/to/rules.conf%0A%23%0ARuleFile%3D/etc/usbguard/rules.conf%0A%0A%23%0A%23%20Rule%20set%20folder%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20folder%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%20Usually%2C%20we%20set%20the%20option%20to%0A%23%20/etc/usbguard/rules.d/.%20The%20USBGuard%20daemon%20is%20supposed%20to%0A%23%20behave%20like%20any%20other%20standard%20Linux%20daemon%20therefore%20it%0A%23%20loads%20rule%20files%20in%20alpha-numeric%20order.%20File%20names%20inside%0A%23%20RuleFolder%20directory%20should%20start%20with%20a%20two-digit%20number%0A%23%20prefix%20indicating%20the%20position%2C%20in%20which%20the%20rules%20are%0A%23%20scanned%20by%20the%20daemon.%0A%23%0A%23%20RuleFolder%3D/path/to/rulesfolder/%0A%23%0ARuleFolder%3D/etc/usbguard/rules.d/%0A%0A%23%0A%23%20Implicit%20policy%20target.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20don%27t%20match%20any%20rule%20in%20the%0A%23%20policy.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20-%20authorize%20the%20device%0A%23%20%2A%20block%20%20-%20block%20the%20device%0A%23%20%2A%20reject%20-%20remove%20the%20device%0A%23%0AImplicitPolicyTarget%3Dblock%0A%0A%23%0A%23%20Present%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20are%20already%20connected%20when%20the%0A%23%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Present%20controller%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20controllers%20that%20are%20already%20connected%0A%23%20when%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentControllerPolicy%3Dkeep%0A%0A%23%0A%23%20Inserted%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20devices%20that%20are%20already%20connected%0A%23%20%2Aafter%2A%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0AInsertedDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Control%20which%20devices%20are%20authorized%20by%20default.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20the%20default%20authorization%20state%20attributes%0A%23%20of%20controller%20devices.%20This%20setting%2C%20enables%20you%20to%20define%20what%20value%20the%0A%23%20default%20authorization%20is%20set%20to.%0A%23%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20do%20not%20change%20the%20authorization%20state%0A%23%20%2A%20none%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20deauthorized%0A%23%20%2A%20all%20%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20authorized%0A%23%20%2A%20internal%20%20%20%20%20-%20internal%20devices%20start%20out%20authorized%2C%20external%20devices%20start%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20out%20deauthorized%20%28this%20requires%20the%20ACPI%20tables%20to%20properly%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20label%20internal%20devices%2C%20and%20kernel%20support%29%0A%23%0A%23AuthorizedDefault%3Dnone%0A%0A%23%0A%23%20Restore%20controller%20device%20state.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20attributes%20of%20controller%0A%23%20devices%20like%20the%20default%20authorization%20state%20of%20new%20child%20device%0A%23%20instances.%20Using%20this%20setting%2C%20you%20can%20control%20whether%20the%0A%23%20daemon%20will%20try%20to%20restore%20the%20attribute%20values%20to%20the%20state%0A%23%20before%20modification%20on%20shutdown.%0A%23%0A%23%20SECURITY%20CONSIDERATIONS%3A%20If%20set%20to%20true%2C%20the%20USB%20authorization%0A%23%20policy%20could%20be%20bypassed%20by%20performing%20some%20sort%20of%20attack%20on%20the%0A%23%20daemon%20%28via%20a%20local%20exploit%20or%20via%20a%20USB%20device%29%20to%20make%20it%20shutdown%0A%23%20and%20restore%20to%20the%20operating-system%20default%20state%20%28known%20to%20be%20permissive%29.%0A%23%0ARestoreControllerDeviceState%3Dfalse%0A%0A%23%0A%23%20Device%20manager%20backend%0A%23%0A%23%20Which%20device%20manager%20backend%20implementation%20to%20use.%20One%20of%3A%0A%23%0A%23%20%2A%20uevent%20%20%20-%20Netlink%20based%20implementation%20which%20uses%20sysfs%20to%20scan%20for%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20devices%20and%20an%20uevent%20netlink%20socket%20for%20receiving%20USB%20device%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20related%20events.%0A%23%20%2A%20umockdev%20-%20umockdev%20based%20device%20manager%20capable%20of%20simulating%20devices%20based%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20on%20umockdev-record%20files.%20Useful%20for%20testing.%0A%23%0ADeviceManagerBackend%3Duevent%0A%0A%23%21%21%21%20WARNING%3A%20It%27s%20good%20practice%20to%20set%20at%20least%20one%20of%20the%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20two%20options%20bellow.%20If%20none%20of%20them%20are%20set%2C%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20the%20daemon%20will%20accept%20IPC%20connections%20from%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20anyone%2C%20thus%20allowing%20anyone%20to%20modify%20the%20%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20rule%20set%20and%20%28de%29authorize%20USB%20devices.%20%20%20%20%20%20%20%21%21%21%0A%0A%23%0A%23%20Users%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20usernames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedUsers%3Dusername1%20username2%20...%0A%23%0AIPCAllowedUsers%3Droot%0A%0A%23%0A%23%20Groups%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20groupnames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedGroups%3Dgroupname1%20groupname2%20...%0A%23%0AIPCAllowedGroups%3Dwheel%0A%0A%23%0A%23%20IPC%20access%20control%20definition%20files%20path.%0A%23%0A%23%20The%20files%20at%20this%20location%20will%20be%20interpreted%20by%20the%20daemon%0A%23%20as%20access%20control%20definition%20files.%20The%20%28base%29name%20of%20a%20file%0A%23%20should%20be%20in%20the%20form%3A%0A%23%0A%23%20%20%20%5Buser%5D%5B%3A%3Cgroup%3E%5D%0A%23%0A%23%20and%20should%20contain%20lines%20in%20the%20form%3A%0A%23%0A%23%20%20%20%3Csection%3E%3D%5Bprivilege%5D%20...%0A%23%0A%23%20This%20way%20each%20file%20defines%20who%20is%20able%20to%20connect%20to%20the%20IPC%0A%23%20bus%20and%20what%20privileges%20he%20has.%0A%23%0AIPCAccessControlFiles%3D/etc/usbguard/IPCAccessControl.d/%0A%0A%23%0A%23%20Generate%20device%20specific%20rules%20including%20the%20%22via-port%22%0A%23%20attribute.%0A%23%0A%23%20This%20option%20modifies%20the%20behavior%20of%20the%20allowDevice%0A%23%20action.%20When%20instructed%20to%20generate%20a%20permanent%20rule%2C%0A%23%20the%20action%20can%20generate%20a%20port%20specific%20rule.%20Because%0A%23%20some%20systems%20have%20unstable%20port%20numbering%2C%20the%20generated%0A%23%20rule%20might%20not%20match%20the%20device%20after%20rebooting%20the%20system.%0A%23%0A%23%20If%20set%20to%20false%2C%20the%20generated%20rule%20will%20still%20contain%0A%23%20the%20%22parent-hash%22%20attribute%20which%20also%20defines%20an%20association%0A%23%20to%20the%20parent%20device.%20See%20usbguard-rules.conf%285%29%20for%20more%0A%23%20details.%0A%23%0ADeviceRulesWithPort%3Dfalse%0A%0A%23%0A%23%20USBGuard%20Audit%20events%20log%20backend%0A%23%0A%23%20One%20of%3A%0A%23%0A%23%20%2A%20FileAudit%20-%20Log%20audit%20events%20into%20a%20file%20specified%20by%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20AuditFilePath%20setting%20%28see%20below%29%0A%23%20%2A%20LinuxAudit%20-%20Log%20audit%20events%20using%20the%20Linux%20Audit%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20subsystem%20%28using%20audit_log_user_message%29%0A%23%0AAuditBackend%3DLinuxAudit%0A%0A%23%0A%23%20USBGuard%20audit%20events%20log%20file%20path.%0A%23%0A%23AuditFilePath%3D/var/log/usbguard/usbguard-audit.log%0A%0A%23%0A%23%20Hides%20personally%20identifiable%20information%20such%20as%20device%20serial%20numbers%20and%0A%23%20hashes%20of%20descriptors%20%28which%20include%20the%20serial%20number%29%20from%20audit%20entries.%0A%23%0A%23HidePII%3Dfalse }} - mode: 0600 - path: /etc/usbguard/usbguard-daemon.conf - overwrite: true - - - - - - - - - - Authorize Human Interface Devices in USBGuard daemon - To allow authorization of Human Interface Devices (keyboard, mouse) -by USBGuard daemon, -add the line -allow with-interface match-all { 03:*:* } -to /etc/usbguard/rules.conf. - This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices are allowed. This assumes that an administrator modified the file with some purpose in mind. - FMT_SMF_EXT.1 - SRG-OS-000114-GPOS-00059 - Without allowing Human Interface Devices, it might not be possible -to interact with the system. - - - - - - - - - - Authorize Human Interface Devices and USB hubs in USBGuard daemon - To allow authorization of USB devices combining human interface device and hub capabilities -by USBGuard daemon, -add the line -allow with-interface match-all { 03:*:* 09:00:* } -to /etc/usbguard/rules.conf. - This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices and hubs are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices and hubs are allowed. This assumes that an administrator modified the file with some purpose in mind. - CM-8(3) - IA-3 - FMT_SMF_EXT.1 - SRG-OS-000114-GPOS-00059 - Without allowing Human Interface Devices, it might not be possible -to interact with the system. Without allowing hubs, it might not be possible to use any -USB devices on the system. - - CCE-82539-8 - --- -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - annotations: - complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed -spec: - config: - ignition: - version: 3.1.0 - storage: - files: - - contents: - source: data:,{{ %0Aallow%20with-interface%20match-all%20%7B%2003%3A%2A%3A%2A%2009%3A00%3A%2A%20%7D }} - mode: 0600 - path: /etc/usbguard/rules.d/75-hid-and-hub.conf - overwrite: true - - - - - - - - - - Authorize USB hubs in USBGuard daemon - To allow authorization of USB hub devices by USBGuard daemon, -add line -allow with-interface match-all { 09:00:* } -to /etc/usbguard/rules.conf. - This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB hub devices are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB hub devices are allowed. This assumes that an administrator modified the file with some purpose in mind. - FMT_SMF_EXT.1 - SRG-OS-000114-GPOS-00059 - Without allowing hubs, it might not be possible to use any -USB devices on the system. - - - - - - - - - - - X Window System - The X Window System implementation included with the -system is called X.org. - - Disable X Windows - Unless there is a mission-critical reason for the -system to run a graphical user interface, ensure X is not set to start -automatically at boot and remove the X Windows software packages. -There is usually no reason to run X Windows -on a dedicated server system, as it increases the system's attack surface and consumes -system resources. Administrators of server systems should instead login via -SSH or on the text console. - - - - - Introduction - The purpose of this guidance is to provide security configuration -recommendations and baselines for the Red Hat Enterprise Linux CoreOS 4 operating -system. Recommended settings for the basic operating system are provided, -as well as for many network services that the system can provide to other systems. -The guide is intended for system administrators. Readers are assumed to -possess basic system administration skills for Unix-like systems, as well -as some familiarity with the product's documentation and administration -conventions. Some instructions within this guide are complex. -All directions should be followed completely and with understanding of -their effects in order to avoid serious adverse effects on the system -and its security. - - General Principles - The following general principles motivate much of the advice in this -guide and should also influence any configuration decisions that are -not explicitly covered. - - Encrypt Transmitted Data Whenever Possible - Data transmitted over a network, whether wired or wireless, is susceptible -to passive monitoring. Whenever practical solutions for encrypting -such data exist, they should be applied. Even if data is expected to -be transmitted only over a local network, it should still be encrypted. -Encrypting authentication data, such as passwords, is particularly -important. Networks of Red Hat Enterprise Linux CoreOS 4 machines can and should be configured -so that no unencrypted authentication data is ever transmitted between -machines. - - - Least Privilege - Grant the least privilege necessary for user accounts and software to perform tasks. -For example, sudo can be implemented to limit authorization to super user -accounts on the system only to designated personnel. Another example is to limit -logins on server systems to only those administrators who need to log into them in -order to perform administration tasks. Using SELinux also follows the principle of -least privilege: SELinux policy can confine software to perform only actions on the -system that are specifically allowed. This can be far more restrictive than the -actions permissible by the traditional Unix permissions model. - - - Minimize Software to Minimize Vulnerability - The simplest way to avoid vulnerabilities in software is to avoid -installing that software. On Red Hat Enterprise Linux CoreOS 4,the RPM Package Manager (originally Red Hat Package Manager, abbreviated RPM) -allows for careful management of -the set of software packages installed on a system. Installed software -contributes to system vulnerability in several ways. Packages that -include setuid programs may provide local attackers a potential path to -privilege escalation. Packages that include network services may give -this opportunity to network-based attackers. Packages that include -programs which are predictably executed by local users (e.g. after -graphical login) may provide opportunities for trojan horses or other -attack code to be run undetected. The number of software packages -installed on a system can almost always be significantly pruned to include -only the software for which there is an environmental or operational need. - - - Run Different Network Services on Separate Systems - Whenever possible, a server should be dedicated to serving exactly one -network service. This limits the number of other services that can -be compromised in the event that an attacker is able to successfully -exploit a software flaw in one network service. - - - Configure Security Tools to Improve System Robustness - Several tools exist which can be effectively used to improve a system's -resistance to and detection of unknown attacks. These tools can improve -robustness against attack at the cost of relatively little configuration -effort. In particular, this guide recommends and discusses the use of -host-based firewalling, SELinux for protection against -vulnerable services, and a logging and auditing infrastructure for -detection of problems. - - - - How to Use This Guide - Readers should heed the following points when using the guide. - - Formatting Conventions - Commands intended for shell execution, as well as configuration file text, -are featured in a monospace font. Italics are used -to indicate instances where the system administrator must substitute -the appropriate information into a command or configuration file. - - - Read Sections Completely and in Order - Each section may build on information and recommendations discussed in -prior sections. Each section should be read and understood completely; -instructions should never be blindly applied. Relevant discussion may -occur after instructions for an action. - - - Reboot Required - A system reboot is implicitly required after some actions in order to -complete the reconfiguration of the system. In many cases, the changes -will not take effect until a reboot is performed. In order to ensure -that changes are applied properly and to test functionality, always -reboot the system after applying a set of recommendations from this guide. - - - Root Shell Environment Assumed - Most of the actions listed in this document are written with the -assumption that they will be executed by the root user running the -/bin/bash shell. Commands preceded with a hash mark (#) -assume that the administrator will execute the commands as root, i.e. -apply the command via sudo whenever possible, or use -su to gain root privileges if sudo cannot be -used. Commands which can be executed as a non-root user are are preceded -by a dollar sign ($) prompt. - - - Test in Non-Production Environment - This guidance should always be tested in a non-production environment -before deployment. This test environment should simulate the setup in -which the system will be deployed as closely as possible. - - - - - - - - - combine_ovals.py from SCAP Security Guide - ssg: [0, 1, 64], python: 3.10.6 - 5.11 - 2022-08-11T18:55:18 - - - - - Disable Kerberos by removing host keytab - - Red Hat Enterprise Linux CoreOS 4 - - Check that there is no Kerberos keytab file present in /etc - - - - - - - - - Configure System to Forward All Mail For The Root Account - - Red Hat Enterprise Linux CoreOS 4 - - Check if root has the correct mail alias. - - - - - - - - - Configure System to Forward All Mail From Postmaster to The Root Account - - Red Hat Enterprise Linux CoreOS 4 - - Check if postmaster has the correct mail alias. - - - - - - - - - Disable chrony daemon from acting as server - - Red Hat Enterprise Linux CoreOS 4 - - Configure the port setting in {{{ chrony_conf_path }}} to disable - server operation. - - - - - - - - - - - Disable network management of chrony daemon - - Red Hat Enterprise Linux CoreOS 4 - - Configure the cmdport setting in {{{ chrony_conf_path }}} to disable - chronyc management connections over network. - - - - - - - - - - - Configure Time Service Maxpoll Interval - - Red Hat Enterprise Linux CoreOS 4 - - Configure the maxpoll setting in /etc/ntp.conf or chrony.conf - to continuously poll the time source servers. - - - - - - - - - - - - - - - - - - - - - - - Specify Additional Remote NTP Servers - - Red Hat Enterprise Linux CoreOS 4 - - Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met) - - - - - - - - - - - - - - - - - Specify a Remote NTP Server - - Red Hat Enterprise Linux CoreOS 4 - - A remote chronyd or ntpd NTP Server for time synchronization should be specified (and dependencies are met) - - - - - - - - - - - - - - - - - Ensure Chrony is only configured with the server directive - - Red Hat Enterprise Linux CoreOS 4 - - Ensure Chrony has time sources configured with server directive - - - - - - - - - - A remote time server for Chrony is configured - - Red Hat Enterprise Linux CoreOS 4 - - A remote NTP Server for time synchronization should be - specified (and dependencies are met) - - - - - - - - - Specify Additional Remote NTP Servers - - Red Hat Enterprise Linux CoreOS 4 - - Multiple ntpd NTP Servers for time synchronization should be specified. - - - - - - - - - Specify a Remote NTP Server - - Red Hat Enterprise Linux CoreOS 4 - - A remote ntpd NTP Server for time synchronization should be - specified (and dependencies are met) - - - - - - - - - Enable the NTP Daemon - - Red Hat Enterprise Linux CoreOS 4 - - At least one of the chronyd or ntpd services should be enabled if possible. - - - - - - - - - - - Remove Rsh Trust Files - - Red Hat Enterprise Linux CoreOS 4 - - There should not be any .rhosts or hosts.equiv files on the system. - - - - - - - - - - - Verify Permissions on SSH Server Private *_key Key Files - - Red Hat Enterprise Linux CoreOS 4 - - The system sshd key is owned by root:root and has the 0600 permission, or by a root:ssh_keys with the 0640 permission - - - - - - - - - Configure session renegotiation for SSH client - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'RekeyLimit' is configured with the correct value in /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/*.conf - - - - - - - - - - Allow Only SSH Protocol 2 - - Red Hat Enterprise Linux CoreOS 4 - - The OpenSSH daemon should be running protocol 2. - - - - - - - - - - - - - - - - - - - - Disable Compression Or Set Compression to delayed - - Red Hat Enterprise Linux CoreOS 4 - - SSH should either have compression disabled or set to delayed. - - - - - - - - - - - - - - - - - Disable SSH Support for Rhosts RSA Authentication - - Red Hat Enterprise Linux CoreOS 4 - - SSH can allow authentication through the obsolete rsh command - through the use of the authenticating user's SSH keys. This should be disabled. - - - - - - - - - - - - - - - - - - - - Force frequent session key renegotiation - - Red Hat Enterprise Linux CoreOS 4 - - Ensure {{{ parameter }}} is configured with the appropriate value in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Set SSH Idle Timeout Interval - - Red Hat Enterprise Linux CoreOS 4 - - The SSH idle timeout interval should be set to an - appropriate value. - - - - - - - - - - - - - - - - - - - - - Set SSH Client Alive Count Max - - Red Hat Enterprise Linux CoreOS 4 - - The SSH ClientAliveCountMax should be set to an appropriate - value (and dependencies are met) - - - - - - - - - - - - - - - - - - - - Ensure SSH LoginGraceTime is configured - - Red Hat Enterprise Linux CoreOS 4 - - The SSH number seconds for login grace time should be set to an - appropriate value. - - - - - - - - - - - - - - - - - Set SSH authentication attempt limit - - Red Hat Enterprise Linux CoreOS 4 - - The SSH MaxAuthTries should be set to an - appropriate value. - - - - - - - - - - Set SSH MaxSessions limit - - Red Hat Enterprise Linux CoreOS 4 - - The SSH number of max sessions should be set to an - appropriate value. - - - - - - - - - - - - - - - - - Ensure SSH MaxStartups is configured - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'MaxStartups' is configured in - '/etc/ssh/sshd_config' - - - - - - - - - - - - - - - - - Enable Use of Privilege Separation - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'UsePrivilegeSeparation' is configured with value 'sandbox' in '/etc/ssh/sshd_config' - - - - - - - - - - - - - Enable Smartcards in SSSD - - Red Hat Enterprise Linux CoreOS 4 - - SSSD should be configured to authenticate access to the system - using smart cards. - - - - - - - - - Configure SSSD to Expire Offline Credentials - - Red Hat Enterprise Linux CoreOS 4 - - SSSD should be configured to expire offline credentials after 1 day. - - - - - - - - - Configure SSSD to run as user sssd - - Red Hat Enterprise Linux CoreOS 4 - - SSSD processes should be configured to run as user sssd, not root. - - - - - - - - - - Log USBGuard daemon audit events using Linux Audit - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'AuditBackend' is configured with value 'LinuxAudit' in /etc/usbguard/usbguard-daemon.conf - - - - - - - - - - - - - Authorize Human Interface Devices in USBGuard daemon - - Red Hat Enterprise Linux CoreOS 4 - - Check that /etc/usbguard/rules.conf exists and that it contains at least one non white space character. - - - - - - - - - Authorize Human Interface Devices and USB hubs in USBGuard daemon - - Red Hat Enterprise Linux CoreOS 4 - - Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists. - - - - - - - - - - Authorize USB hubs in USBGuard daemon - - Red Hat Enterprise Linux CoreOS 4 - - Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists. - - - - - - - - - Modify the System Login Banner - - Red Hat Enterprise Linux CoreOS 4 - - The system login banner text should be set correctly. - - - - - - - - - - Disallow Configuration to Bypass Password Requirements for Privilege Escalation - - Red Hat Enterprise Linux CoreOS 4 - - Disallow Configuration to Bypass Password Requirements for Privilege Escalation. - - - - - - - - - Ensure PAM Displays Last Logon/Access Notification - - Red Hat Enterprise Linux CoreOS 4 - - Configure the system to notify users of last login/access using pam_lastlog. - - - - - - - - - - Account Lockouts Must Be Logged - - Red Hat Enterprise Linux CoreOS 4 - - Account Lockouts Must Be Logged - - - - - - - - - - - - - - - - - - Disable Ctrl-Alt-Del Burst Action - - Red Hat Enterprise Linux CoreOS 4 - - Configure the CtrlAltDelBurstAction setting in /etc/systemd/system.conf - or /etc/systemd/system.conf.d/* to none to prevent a reboot if Ctrl-Alt-Delete is - pressed more than 7 times in 2 seconds. - - - - - - - - - - Disable Ctrl-Alt-Del Reboot Activation - - Red Hat Enterprise Linux CoreOS 4 - - By default, the system will reboot when the - Ctrl-Alt-Del key sequence is pressed. - - - - - - - - - - Verify that Interactive Boot is Disabled - - Red Hat Enterprise Linux CoreOS 4 - - The ability for users to perform interactive startups should - be disabled. - - - - - - - - - - - - - - Require Authentication for Single User Mode - - Red Hat Enterprise Linux CoreOS 4 - - The requirement for a password to boot into single-user mode - should be configured correctly. - - - - - - - - - - - - - Support session locking with tmux - - Red Hat Enterprise Linux CoreOS 4 - - Check if tmux is configured to exec at the end of bashrc. - - - - - - - - - Configure tmux to lock session after inactivity - - Red Hat Enterprise Linux CoreOS 4 - - Check if tmux is configured to lock sessions after period of inactivity. - - - - - - - - - - Configure the tmux Lock Command - - Red Hat Enterprise Linux CoreOS 4 - - Check if the vlock command is configured to be used as a locking mechanism in tmux. - - - - - - - - - - Prevent user from disabling the screen lock - - Red Hat Enterprise Linux CoreOS 4 - - Check that tmux is not listed in /etc/shells - - - - - - - - - Set Account Expiration Following Inactivity - - Red Hat Enterprise Linux CoreOS 4 - - The accounts should be configured to expire automatically following password expiration. - - - - - - - - - - Ensure All Accounts on the System Have Unique Names - - Red Hat Enterprise Linux CoreOS 4 - - All accounts on the system should have unique names for proper accountability. - - - - - - - - - Set Password Maximum Age - - Red Hat Enterprise Linux CoreOS 4 - - The maximum password age policy should meet minimum requirements. - - - - - - - - - Set Password Minimum Age - - Red Hat Enterprise Linux CoreOS 4 - - The minimum password age policy should be set appropriately. - - - - - - - - - Set Password Minimum Length in login.defs - - Red Hat Enterprise Linux CoreOS 4 - - The password minimum length should be set appropriately. - - - - - - - - - Set Password Warning Age - - Red Hat Enterprise Linux CoreOS 4 - - The password expiration warning age should be set appropriately. - - - - - - - - - Verify All Account Password Hashes are Shadowed - - Red Hat Enterprise Linux CoreOS 4 - - All password hashes should be shadowed. - - - - - - - - - All GIDs referenced in /etc/passwd must be defined in /etc/group - - Red Hat Enterprise Linux CoreOS 4 - - All GIDs referenced in /etc/passwd must be defined in /etc/group. - - - - - - - - - Prevent Login to Accounts With Empty Password - - Red Hat Enterprise Linux CoreOS 4 - - The file /etc/pam.d/system-auth should not contain the nullok option - - - - - - - - - - Ensure There Are No Accounts With Blank or Null Passwords - - Red Hat Enterprise Linux CoreOS 4 - - The file /etc/shadow shows that there aren't empty passwords - - - - - - - - - Ensure there are no legacy + NIS entries in /etc/group - - Red Hat Enterprise Linux CoreOS 4 - - No lines starting with + are in /etc/group - - - - - - - - - Ensure there are no legacy + NIS entries in /etc/passwd - - Red Hat Enterprise Linux CoreOS 4 - - No lines starting with + are in /etc/passwd - - - - - - - - - Ensure there are no legacy + NIS entries in /etc/shadow - - Red Hat Enterprise Linux CoreOS 4 - - No lines starting with + are in /etc/shadow - - - - - - - - - Verify No netrc Files Exist - - Red Hat Enterprise Linux CoreOS 4 - - The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed. - - - - - - - - - - Verify Only Root Has UID 0 - - Red Hat Enterprise Linux CoreOS 4 - - Only the root account should be assigned a user id of 0. - - - - - - - - - - Verify Root Has A Primary GID 0 - - Red Hat Enterprise Linux CoreOS 4 - - The root account should have primary group of 0 - - - - - - - - - Direct root Logins Not Allowed - - Red Hat Enterprise Linux CoreOS 4 - - Preventing direct root logins help ensure accountability for actions - taken on the system using the root account. - - - - - - - - - - - Ensure that System Accounts Do Not Run a Shell Upon Login - - Red Hat Enterprise Linux CoreOS 4 - - The root account is the only system account that should have - a login shell. - - - - - - - - - - - - - - - - - - - - Restrict Serial Port Root Logins - - Red Hat Enterprise Linux CoreOS 4 - - Preventing direct root login to serial port interfaces helps - ensure accountability for actions taken on the system using the root - account. - - - - - - - - - Restrict Virtual Console Root Logins - - Red Hat Enterprise Linux CoreOS 4 - - Preventing direct root login to virtual console devices - helps ensure accountability for actions taken on the system using the - root account. - - - - - - - - - Ensure the Logon Failure Delay is Set Correctly in login.defs - - Red Hat Enterprise Linux CoreOS 4 - - The delay between failed authentication attempts should be - set for all users specified in /etc/login.defs - - - - - - - - - Limit the Number of Concurrent Login Sessions Allowed Per User - - Red Hat Enterprise Linux CoreOS 4 - - The maximum number of concurrent login sessions per user should meet - minimum requirements. - - - - - - - - - - - - - Configure Polyinstantiation of /tmp Directories - - Red Hat Enterprise Linux CoreOS 4 - - - - - - - - - - - - Configure Polyinstantiation of /var/tmp Directories - - Red Hat Enterprise Linux CoreOS 4 - - - - - - - - - - - - Set Interactive Session Timeout - - Red Hat Enterprise Linux CoreOS 4 - - Checks interactive shell timeout - - - - - - - - - - Ensure that User Home Directories are not Group-Writable or World-Readable - - Red Hat Enterprise Linux CoreOS 4 - - Ensure that User Home Directories are not Group-Writable or World-Readable - - - - - - - - - Ensure that Root's Path Does Not Include World or Group-Writable Directories - - Red Hat Enterprise Linux CoreOS 4 - - Check each directory in root's path and make use it does - not grant write permission to group and other - - - - - - - - - Ensure that Root's Path Does Not Include Relative Paths or Null Directories - - Red Hat Enterprise Linux CoreOS 4 - - The environment variable PATH should be set correctly for - the root user. - - - - - - - - - - - - - - Ensure the Default Bash Umask is Set Correctly - - Red Hat Enterprise Linux CoreOS 4 - - The default umask for users of the bash shell - - - - - - - - - - - Ensure the Default C Shell Umask is Set Correctly - - Red Hat Enterprise Linux CoreOS 4 - - The default umask for users of the csh shell - - - - - - - - - - - Ensure the Default Umask is Set Correctly in login.defs - - Red Hat Enterprise Linux CoreOS 4 - - The default umask for all users specified in /etc/login.defs - - - - - - - - - - Ensure the Default Umask is Set Correctly in /etc/profile - - Red Hat Enterprise Linux CoreOS 4 - - The default umask for all users should be set correctly - - - - - - - - - - - Enable Syscall Auditing - - Red Hat Enterprise Linux CoreOS 4 - - Syscall auditing should not be disabled. - - - - - - - - - - - - - - - - Make the auditd Configuration Immutable - - Red Hat Enterprise Linux CoreOS 4 - - Force a reboot to change audit rules is enabled - - - - - - - - - - - - - - - - - Record Events that Modify the System's Mandatory Access Controls - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled. - - - - - - - - - - - - - - - - - Record Events that Modify the System's Network Environment - - Red Hat Enterprise Linux CoreOS 4 - - The network environment should not be modified by anything other than - administrator action. Any change to network parameters should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Attempts to Alter Process and Session Initiation Information - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules should capture information about session initiation. - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects System Administrator Actions - - Red Hat Enterprise Linux CoreOS 4 - - Audit actions taken by system administrators on the system. - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules should detect modification to system files that hold information about users and groups. - - - - - - - - - - - - - - - - - - - - - - - - Record Access Events to Audit Log Directory - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the read events to /var/log/audit - - - - - - - - - - - - - - - - - System Audit Logs Must Have Mode 0750 or Less Permissive - - Red Hat Enterprise Linux CoreOS 4 - - Checks for correct permissions for audit logs. - - - - - - - - - - - - - - - - - - - - - - System Audit Logs Must Be Owned By Root - - Red Hat Enterprise Linux CoreOS 4 - - Checks that all /var/log/audit files and directories are owned by the root user and group. - - - - - - - - - - - - - - - - - - System Audit Logs Must Have Mode 0640 or Less Permissive - - Red Hat Enterprise Linux CoreOS 4 - - Checks for correct permissions for all audit log files. - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - umount - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - - Red Hat Enterprise Linux CoreOS 4 - - Audit files deletion events. - - - - - - - - - - - - - Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - - Red Hat Enterprise Linux CoreOS 4 - - The audit rules should be configured to log information about kernel module loading and unloading. - - - - - - - - - - - Ensure auditd Collects Information on Kernel Module Unloading - delete_module - - Red Hat Enterprise Linux CoreOS 4 - - The audit rules should be configured to log information about kernel module loading and unloading. - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module - - Red Hat Enterprise Linux CoreOS 4 - - The audit rules should be configured to log information about kernel module loading and unloading. - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on Kernel Module Loading - init_module - - Red Hat Enterprise Linux CoreOS 4 - - The audit rules should be configured to log information about kernel module loading and unloading. - - - - - - - - - - - - - - - - - - - - - - - - - Record Attempts to Alter Logon and Logout Events - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules should be configured to log successful and unsuccessful login and logout events. - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of privileged commands are enabled. - - - - - - - - - - - - - - - - - - - Record attempts to alter time through adjtimex - - Red Hat Enterprise Linux CoreOS 4 - - Record attempts to alter time through adjtimex. - - - - - - - - - - - - - - - - - - - - - - - - - Record Attempts to Alter Time Through clock_settime - - Red Hat Enterprise Linux CoreOS 4 - - Record attempts to alter time through clock_settime. - - - - - - - - - - - - - - - - - - - - - - - - - Record attempts to alter time through settimeofday - - Red Hat Enterprise Linux CoreOS 4 - - Record attempts to alter time through settimeofday. - - - - - - - - - - - - - - - - - - - - - - - - - Record Attempts to Alter Time Through stime - - Red Hat Enterprise Linux CoreOS 4 - - Record attempts to alter time through stime. Note that on - 64-bit architectures the stime system call is not defined in the audit - system calls lookup table. - - - - - - - - - - - - - - - - - - - - - - - Record Attempts to Alter the localtime File - - Red Hat Enterprise Linux CoreOS 4 - - Record attempts to alter time through /etc/localtime. - - - - - - - - - - - - - - - - - Configure audispd Plugin To Send Logs To Remote Server - - Red Hat Enterprise Linux CoreOS 4 - - remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname - - - - - - - - - Configure audispd's Plugin disk_full_action When Disk Is Full - - Red Hat Enterprise Linux CoreOS 4 - - remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname - - - - - - - - - Encrypt Audit Records Sent With audispd Plugin - - Red Hat Enterprise Linux CoreOS 4 - - enable_krb5 setting in /etc/audit/audisp-remote.conf is set to 'yes' - - - - - - - - - Configure audispd's Plugin network_failure_action On Network Failure - - Red Hat Enterprise Linux CoreOS 4 - - remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname - - - - - - - - - Configure auditd to use audispd's syslog plugin - - Red Hat Enterprise Linux CoreOS 4 - - active setting in /etc/audit/plugins.d/syslog.conf is set to 'yes' - - - - - - - - - Configure auditd Disk Error Action on Disk Error - - Red Hat Enterprise Linux CoreOS 4 - - disk_error_action setting in /etc/audit/auditd.conf is set to a certain action - - - - - - - - - - Configure auditd Disk Error Action on Disk Error - - Red Hat Enterprise Linux CoreOS 4 - - disk_error_action setting in /etc/audit/auditd.conf is set to SYSLOG, SINGLE or HALT - - - - - - - - - - - Configure auditd Disk Full Action when Disk Space Is Full - - Red Hat Enterprise Linux CoreOS 4 - - disk_full_action setting in /etc/audit/auditd.conf is set to a certain action - - - - - - - - - - Configure auditd Disk Full Action when Disk Space Is Full - - Red Hat Enterprise Linux CoreOS 4 - - disk_full_action setting in /etc/audit/auditd.conf is set to SYSLOG, SINGLE or HALT - - - - - - - - - - - Configure auditd mail_acct Action on Low Disk Space - - Red Hat Enterprise Linux CoreOS 4 - - action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account - - - - - - - - - - Configure auditd admin_space_left Action on Low Disk Space - - Red Hat Enterprise Linux CoreOS 4 - - admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action - - - - - - - - - - Configure auditd flush priority - - Red Hat Enterprise Linux CoreOS 4 - - The setting for flush in /etc/audit/auditd.conf - - - - - - - - - - Configure auditd Max Log File Size - - Red Hat Enterprise Linux CoreOS 4 - - max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value - - - - - - - - - - Configure auditd max_log_file_action Upon Reaching Maximum Log Size - - Red Hat Enterprise Linux CoreOS 4 - - max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action - - - - - - - - - - Configure auditd max_log_file_action Upon Reaching Maximum Log Size - - Red Hat Enterprise Linux CoreOS 4 - - max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action - - - - - - - - - - Configure auditd Number of Logs Retained - - Red Hat Enterprise Linux CoreOS 4 - - num_logs setting in /etc/audit/auditd.conf is set to at least a certain value - - - - - - - - - - Configure auditd space_left on Low Disk Space - - Red Hat Enterprise Linux CoreOS 4 - - space_left setting in /etc/audit/auditd.conf is set to at least a certain value - - - - - - - - - - Configure auditd space_left Action on Low Disk Space - - Red Hat Enterprise Linux CoreOS 4 - - space_left_action setting in /etc/audit/auditd.conf is set to a certain action - - - - - - - - - - Appropriate Action Must be Setup When the Internal Audit Event Queue is Full - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'overflow_action' is configured with value '(syslog|single|halt)' in /etc/audit/auditd.conf - - - - - - - - - Configure audit according to OSPP requirements - - Red Hat Enterprise Linux CoreOS 4 - - Compare configure audit rules against the recommended pre-configured files. - - - - - - - - - - - - Disable Recovery Booting - - Red Hat Enterprise Linux CoreOS 4 - - Recovery mode should be disabled. - - - - - - - - - Set the UEFI Boot Loader Admin Username to a Non-Default Value - - Red Hat Enterprise Linux CoreOS 4 - - The grub2 boot loader superuser should have a username that is hard to guess. - - - - - - - - - - Set the UEFI Boot Loader Password - - Red Hat Enterprise Linux CoreOS 4 - - The UEFI grub2 boot loader should have password protection enabled. - - - - - - - - - - Ensure all zIPL boot entries are BLS compliant - - Red Hat Enterprise Linux CoreOS 4 - - Check if /etc/zipl.conf configures any boot entry - - - - - - - - - Ensure zIPL bootmap is up to date - - Red Hat Enterprise Linux CoreOS 4 - - Check if /boot/bootmap is up to date - - - - - - - - - Ensure debug-shell service is not enabled in zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Ensure systemd.debug-shell option is not configured in the 'options' line in /boot/loader/entries/*.conf. Make sure that newly installed kernels won't have this option, it should not be configured in /etc/kernel/cmdline. - - - - - - - - - - Ensure Rsyslog Authenticates Off-Loaded Audit Records - - Red Hat Enterprise Linux CoreOS 4 - - Rsyslogd must authenticate remote system its sending logs to. - - - - - - - - - - - - Ensure Rsyslog Encrypts Off-Loaded Audit Records - - Red Hat Enterprise Linux CoreOS 4 - - Rsyslogd must encrypt the off-loading of logs off of the system. - - - - - - - - - - - - Ensure Rsyslog Encrypts Off-Loaded Audit Records - - Red Hat Enterprise Linux CoreOS 4 - - Rsyslogd must encrypt the off-loading of logs off of the system. - - - - - - - - - - - - Ensure Log Files Are Owned By Appropriate Group - - Red Hat Enterprise Linux CoreOS 4 - - All syslog log files should be owned by the appropriate group. - - - - - - - - - Ensure Log Files Are Owned By Appropriate User - - Red Hat Enterprise Linux CoreOS 4 - - All syslog log files should be owned by the appropriate user. - - - - - - - - - Ensure System Log Files Have Correct Permissions - - Red Hat Enterprise Linux CoreOS 4 - - File permissions for all syslog log files should be set correctly. - - - - - - - - - Ensure Logrotate Runs Periodically - - Red Hat Enterprise Linux CoreOS 4 - - - The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily - - - - - - - - - - - - - Ensure Logs Sent To Remote Host - - Red Hat Enterprise Linux CoreOS 4 - - Syslog logs should be sent to a remote loghost - - - - - - - - - - Prevent non-Privileged Users from Modifying Network Interfaces using nmcli - - Red Hat Enterprise Linux CoreOS 4 - - polkit is properly configured to prevent non-privileged users from changing networking settings - - - - - - - - - - Disable IPv6 Networking Support Automatic Loading - - Red Hat Enterprise Linux CoreOS 4 - - The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack. - - - - - - - - - Deactivate Wireless Network Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - All wireless interfaces should be disabled. - - - - - - - - - - Verify that All World-Writable Directories Have Sticky Bits Set - - Red Hat Enterprise Linux CoreOS 4 - - The sticky bit should be set for all world-writable directories. - - - - - - - - - - Verify that local System.map file (if exists) is readable only by root - - Red Hat Enterprise Linux CoreOS 4 - - - Checks that /boot/System.map-* are only readable by root. - - - - - - - - - - Ensure No World-Writable Files Exist - - Red Hat Enterprise Linux CoreOS 4 - - The world-write permission should be disabled for all files. - - - - - - - - - Verify that System Executables Have Root Ownership - - Red Hat Enterprise Linux CoreOS 4 - - - Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, - /usr/local/sbin, /usr/libexec, and objects therein, are owned by root. - - - - - - - - - - - Verify that System Executables Have Restrictive Permissions - - Red Hat Enterprise Linux CoreOS 4 - - - Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin, - /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable. - - - - - - - - - - Disable Kernel Support for USB via Bootloader Configuration - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'GRUB_CMDLINE_LINUX' is configured with value 'nousb' in /etc/default/grub - - - - - - - - - - Add nodev Option to Non-Root Local Partitions - - Red Hat Enterprise Linux CoreOS 4 - - The nodev mount option prevents files from being interpreted - as character or block devices. Legitimate character and block devices - should exist in the /dev directory on the root partition or within chroot - jails built for system services. All other locations should not allow - character and block devices. - - - - - - - - - Disable core dump backtraces - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'ProcessSizeMax' is configured with value '0 in section 'Coredump' in /etc/systemd/coredump.conf - - - - - - - - - - Disable storing core dump - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'Storage' is configured with value 'none in section 'Coredump' in /etc/systemd/coredump.conf - - - - - - - - - - Disable Core Dumps for All Users - - Red Hat Enterprise Linux CoreOS 4 - - Core dumps for all users should be disabled - - - - - - - - - - - - - - Ensure SELinux Not Disabled in /etc/default/grub - - Red Hat Enterprise Linux CoreOS 4 - - - Check if selinux=0 OR enforcing=0 within the GRUB2 configuration files, fail if found. - - - - - - - - - - - - - Ensure No Daemons are Unconfined by SELinux - - Red Hat Enterprise Linux CoreOS 4 - - All pids in /proc should be assigned an SELinux security context other than 'unconfined_service_t'. - - - - - - - - - - Configure SELinux Policy - - Red Hat Enterprise Linux CoreOS 4 - - The SELinux policy should be set appropriately. - - - - - - - - - - Ensure SELinux State is Enforcing - - Red Hat Enterprise Linux CoreOS 4 - - The SELinux state should be enforcing the local policy. - - - - - - - - - - Prefer to use a 64-bit Operating System when supported - - Red Hat Enterprise Linux CoreOS 4 - - Check if the system supports a 64-bit Operating System - - - - - - - - - - Disable XDMCP in GDM - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'Enable' is configured with value 'false in section 'xdmcp' in /etc/gdm/custom.conf - - - - - - - - - - - - Disable Prelinking - - Red Hat Enterprise Linux CoreOS 4 - - The prelinking feature can interfere with the operation of - checksum integrity tools (e.g. AIDE), mitigates the protection provided - by ASLR, and requires additional CPU cycles by software upgrades. - - - - - - - - - - - The Installed Operating System Is FIPS 140-2 Certified - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is a certified operating system that meets FIPS 140-2 requirements. - - - - - - - - - - - - - - - - - - Configure BIND to use System Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - BIND should be configured to use the system-wide crypto policy setting. - - - - - - - - - - - Configure System Cryptography Policy - - Red Hat Enterprise Linux CoreOS 4 - - Ensure crypto policy is correctly configured in /etc/crypto-policies/config, and the policy is current. - - - - - - - - - - - - - Configure Kerberos to use System Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - Kerberos should be configured to use the system-wide crypto policy setting. - - - - - - - - - - - Configure Libreswan to use System Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - Libreswan should be configured to use the system-wide crypto policy setting. - - - - - - - - - - - Configure OpenSSL library to use System Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - OpenSSL should be configured to use the system-wide crypto policy setting. - - - - - - - - - - Configure SSH to use System Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - SSH should be configured to use the system-wide crypto policy setting. - - - - - - - - - Harden OpenSSL Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'Ciphersuites' is configured with value 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256' in /etc/crypto-policies/back-ends/opensslcnf.config - - - - - - - - - - Harden SSH client Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - Ensure the ssh client ciphers are configured correctly in /etc/ssh/ssh_config.d/02-ospp.conf - - - - - - - - - - - - - - - - Harden SSHD Crypto Policy - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'CRYPTO_POLICY' is configured with value ''-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'' in /etc/crypto-policies/back-ends/opensshserver.config - - - - - - - - - - - - - - - - - - - - Install McAfee Virus Scanning Software - - Red Hat Enterprise Linux CoreOS 4 - - McAfee Antivirus software should be installed. - - - - - - - - - - Install the McAfee Runtime Libraries and Linux Agent - - Red Hat Enterprise Linux CoreOS 4 - - Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma). - - - - - - - - - - Install the Asset Configuration Compliance Module (ACCM) - - Red Hat Enterprise Linux CoreOS 4 - - Install the Asset Configuration Compliance Module (ACCM). - - - - - - - - - Install the Policy Auditor (PA) Module - - Red Hat Enterprise Linux CoreOS 4 - - Install the Policy Auditor (PA) Module. - - - - - - - - - Enable Dracut FIPS Module - - Red Hat Enterprise Linux CoreOS 4 - - fips module should be enabled in Dracut configuration - - - - - - - - - - Enable FIPS Mode - - Red Hat Enterprise Linux CoreOS 4 - - Check if FIPS mode is enabled on the system - - - - - - - - - - - - - Ensure '/etc/system-fips' exists - - Red Hat Enterprise Linux CoreOS 4 - - Check /etc/system-fips exists - - - - - - - - - Enable FIPS Mode in GRUB2 - - Red Hat Enterprise Linux CoreOS 4 - - Ensure fips=1 is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - - - - - - - Install the dracut-fips-aesni Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package dracut-fips-aesni should be installed. - - - - - - - - - - - - - Install the dracut-fips Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package dracut-fips should be installed. - - - - - - - - - - Set kernel parameter 'crypto.fips_enabled' to 1 - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'crypto.fips_enabled' parameter should be set to '1' in system runtime. - - - - - - - - - Build and Test AIDE Database - - Red Hat Enterprise Linux CoreOS 4 - - The aide database must be initialized. - - - - - - - - - - - Verify and Correct Ownership with RPM - - Red Hat Enterprise Linux CoreOS 4 - - Verify ownership of installed packages - by comparing the installed files with information about the - files taken from the package metadata stored in the RPM - database. - - - - - - - - - - - Verify and Correct File Permissions with RPM - - Red Hat Enterprise Linux CoreOS 4 - - Verify the permissions of installed packages - by comparing the installed files with information about the - files taken from the package metadata stored in the RPM - database. - - - - - - - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudo usage without authentication - - - - - - - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudo usage without password - - - - - - - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudo usage without password - - - - - - - - - - Only the VDSM User Can Use sudo NOPASSWD - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudo usage for the vdsm user without a password - - - - - - - - - - Explicit arguments in sudo specifications - - Red Hat Enterprise Linux CoreOS 4 - - Check that sudoers doesn't contain commands without arguments specified - - - - - - - - - Don't define allowed commands in sudoers by means of exclusion - - Red Hat Enterprise Linux CoreOS 4 - - Check that sudoers doesn't contain command negations - - - - - - - - - Don't target root user in the sudoers file - - Red Hat Enterprise Linux CoreOS 4 - - Check that sudoers doesn't allow users to run commands as root - - - - - - - - - - Ensure Red Hat GPG Key Installed - - Red Hat Enterprise Linux CoreOS 4 - - The Red Hat release and auxiliary key packages are required to be installed. - - - - - - - - - - - - - - - - - - Configure auditing of unsuccessful file accesses - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules - - - - - - - - - Configure auditing of successful file accesses - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-3-access-success.rules - - - - - - - - - Configure basic parameters of Audit system - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/10-base-config.rules - - - - - - - - - Configure auditing of unsuccessful file creations - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules - - - - - - - - - Configure auditing of successful file creations - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-1-create-success.rules - - - - - - - - - Configure auditing of unsuccessful file deletions - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules - - - - - - - - - Configure auditing of successful file deletions - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules - - - - - - - - - Configure immutable Audit login UIDs - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/11-loginuid.rules - - - - - - - - - Configure auditing of unsuccessful file modifications - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules - - - - - - - - - Configure auditing of successful file modifications - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules - - - - - - - - - Configure auditing of loading and unloading of kernel modules - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/43-module-load.rules - - - - - - - - - Perform general configuration of Audit for OSPP - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42.rules - - - - - - - - - Configure auditing of unsuccessful ownership changes - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules - - - - - - - - - Configure auditing of successful ownership changes - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules - - - - - - - - - Configure auditing of unsuccessful permission changes - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules - - - - - - - - - Configure auditing of successful permission changes - - Red Hat Enterprise Linux CoreOS 4 - - Inspect the contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - init - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of init is enabled. - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - poweroff - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of poweroff is enabled. - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - reboot - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of reboot is enabled. - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - shutdown - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of shutdown is enabled. - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - chmod - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - chown - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchmod - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchmodat - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchown - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fchownat - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fremovexattr - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - fsetxattr - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - lchown - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - lremovexattr - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - lsetxattr - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - removexattr - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - setxattr - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Discretionary Access Controls - umount2 - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open syscall - /etc/group - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/group - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/group - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/group - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/group - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open syscall - /etc/gshadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/gshadow - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/gshadow - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/gshadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/gshadow - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open syscall - /etc/passwd - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/passwd - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/passwd - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/passwd - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/passwd - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open syscall - /etc/shadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/shadow - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/shadow - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information via openat syscall - /etc/shadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the write events to /etc/shadow - - - - - - - - - - - - - - - - - - - - - - - - - Record Any Attempts to Run chcon - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of chcon is enabled. - - - - - - - - - - - - - - - - - Record Any Attempts to Run restorecon - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of restorecon is enabled. - - - - - - - - - - - - - - - - - Record Any Attempts to Run semanage - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of semanage is enabled. - - - - - - - - - - - - - - - - - Record Any Attempts to Run setfiles - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of setfiles is enabled. - - - - - - - - - - - - - - - - - Record Any Attempts to Run setsebool - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of setsebool is enabled. - - - - - - - - - - - - - - - - - Record Any Attempts to Run seunshare - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of seunshare is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - rename - - Red Hat Enterprise Linux CoreOS 4 - - The deletion of files should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - renameat - - Red Hat Enterprise Linux CoreOS 4 - - The deletion of files should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - rmdir - - Red Hat Enterprise Linux CoreOS 4 - - The deletion of files should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - unlink - - Red Hat Enterprise Linux CoreOS 4 - - The deletion of files should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects File Deletion Events by User - unlinkat - - Red Hat Enterprise Linux CoreOS 4 - - The deletion of files should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Record Attempts to Alter Logon and Logout Events - faillock - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules should be configured to log successful and unsuccessful login and logout events. - - - - - - - - - - - - - - - - - Record Attempts to Alter Logon and Logout Events - lastlog - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules should be configured to log successful and unsuccessful login and logout events. - - - - - - - - - - - - - - - - - Record Attempts to Alter Logon and Logout Events - tallylog - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules should be configured to log successful and unsuccessful login and logout events. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on Exporting to Media (successful) - - Red Hat Enterprise Linux CoreOS 4 - - The changing of file permissions and attributes should be audited. - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - at - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of at is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - chage - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of chage is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - chsh - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of chsh is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - crontab - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of crontab is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of gpasswd is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - mount - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of mount is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of newgidmap is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newgrp - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of newgrp is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of newuidmap is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of pam_timestamp_check is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - passwd - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of passwd is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - postdrop - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of postdrop is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - postqueue - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of postqueue is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of pt_chown is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of ssh_keysign is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - su - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of su is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - sudo - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of sudo is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of sudoedit is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - umount - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of umount is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of unix_chkpwd is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - userhelper - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of userhelper is enabled. - - - - - - - - - - - - - - - - - Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the use of usernetctl is enabled. - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - chmod - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - chown - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Access Attempts to Files - creat - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fchmod - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fchmodat - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - fchown - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - fchownat - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fremovexattr - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - fsetxattr - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Access Attempts to Files - ftruncate - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Ownership Changes to Files - lchown - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - lremovexattr - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - lsetxattr - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Access Attempts to Files - open - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Access Attempts to Files - open_by_handle_at - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of open_by_handle_at O_CREAT is enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of open_by_handle_at O_TRUNC is enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of open_by_handle_at is configured in the proper rule order. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Creation Attempts to Files - open O_CREAT - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of open O_CREAT is enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of open O_TRUNC is enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of open is configured in the proper rule order. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Access Attempts to Files - openat - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Creation Attempts to Files - openat O_CREAT - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of openat O_CREAT is enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of openat O_TRUNC is enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the information on the unsuccessful use of openat is configured in the proper rule order. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - removexattr - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - rename - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - renameat - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Permission Changes to Files - setxattr - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Access Attempts to Files - truncate - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - unlink - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Unsuccessful Delete Attempts to Files - unlinkat - - Red Hat Enterprise Linux CoreOS 4 - - Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - /etc/group - - Red Hat Enterprise Linux CoreOS 4 - - Audit user/group modification. - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - /etc/gshadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit user/group modification. - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - /etc/security/opasswd - - Red Hat Enterprise Linux CoreOS 4 - - Audit user/group modification. - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - /etc/passwd - - Red Hat Enterprise Linux CoreOS 4 - - Audit user/group modification. - - - - - - - - - - - - - - - - - Record Events that Modify User/Group Information - /etc/shadow - - Red Hat Enterprise Linux CoreOS 4 - - Audit user/group modification. - - - - - - - - - - - - - - - - - Set number of records to cause an explicit flush to audit logs - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'freq' is configured with value '50' in /etc/audit/auditd.conf - - - - - - - - - - Include Local Events in Audit Logs - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'local_events' is configured with value 'yes' in /etc/audit/auditd.conf - - - - - - - - - - Resolve information before writing to audit logs - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'log_format' is configured with value 'ENRICHED' in /etc/audit/auditd.conf - - - - - - - - - - Set hostname as computer node name in audit logs - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'name_format' is configured with value 'hostname' in /etc/audit/auditd.conf - - - - - - - - - - Write Audit Logs to the Disk - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'write_logs' is configured with value 'yes' in /etc/audit/auditd.conf - - - - - - - - - - - Extend Audit Backlog Limit for the Audit Daemon - - Red Hat Enterprise Linux CoreOS 4 - - Ensure audit_backlog_limit=8192 argument is present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Enable Auditing for Processes Which Start Prior to the Audit Daemon - - Red Hat Enterprise Linux CoreOS 4 - - Ensure audit=1 argument is present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Verify that Interactive Boot is Disabled - - Red Hat Enterprise Linux CoreOS 4 - - Ensure systemd.confirm_spawn=(?:1|yes|true|on) argument is not present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Ensure SELinux Not Disabled in the kernel arguments - - Red Hat Enterprise Linux CoreOS 4 - - Ensure selinux=0 argument is not present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Disable Kernel Support for USB via Bootloader Configuration - - Red Hat Enterprise Linux CoreOS 4 - - Ensure nousb argument is present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Enable page allocator poisoning - - Red Hat Enterprise Linux CoreOS 4 - - Ensure page_poison=1 argument is present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Enable Kernel Page-Table Isolation (KPTI) - - Red Hat Enterprise Linux CoreOS 4 - - Ensure pti=on argument is present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Enable SLUB/SLAB allocator poisoning - - Red Hat Enterprise Linux CoreOS 4 - - Ensure slub_debug=P argument is present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Disable vsyscalls - - Red Hat Enterprise Linux CoreOS 4 - - Ensure vsyscall=none argument is present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline. - - - - - - - - - - - - - - - - - - - - - Verify that System Executable Have Root Ownership - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /bin/, /sbin/, /usr/bin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/ is owned by 0. - - - - - - - - - - - - - - Verify that Shared Library Directories Have Root Ownership - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is owned by 0. - - - - - - - - - - - - Verify that System Executable Directories Have Restrictive Permissions - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /bin/, /sbin/, /usr/bin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/ has mode 0755. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - - - - - - Verify that Shared Library Directories Have Restrictive Permissions - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ has mode 7755. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - - - - Disable Host-Based Authentication - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'HostbasedAuthentication' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Verify Group Who Owns Backup group File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/group- is group owned by 0. - - - - - - - - - Verify Group Who Owns Backup gshadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/gshadow- is group owned by 0. - - - - - - - - - Verify Group Who Owns Backup passwd File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/passwd- is group owned by 0. - - - - - - - - - Verify User Who Owns Backup shadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/shadow- is group owned by 0. - - - - - - - - - Verify Group Who Owns group File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/group is group owned by 0. - - - - - - - - - Verify Group Who Owns gshadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/gshadow is group owned by 0. - - - - - - - - - Verify Group Ownership of System Login Banner - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/issue is group owned by 0. - - - - - - - - - Verify Group Who Owns passwd File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/passwd is group owned by 0. - - - - - - - - - Verify Group Who Owns shadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/shadow is group owned by 0. - - - - - - - - - Verify Group Who Owns SSH Server config file - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/ssh/sshd_config is group owned by 0. - - - - - - - - - Verify Group Who Owns /var/log Directory - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/ is group owned by 0. - - - - - - - - - Verify Group Who Owns /var/log/messages File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/messages is group owned by 0. - - - - - - - - - Verify Group Who Owns /var/log/syslog File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/syslog is group owned by 4. - - - - - - - - - Audit Configuration Files Must Be Owned By Group root - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/audit/, /etc/audit/rules.d/ is group owned by 0. - - - - - - - - - - Verify User Who Owns Backup group File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/group- is owned by 0. - - - - - - - - - Verify User Who Owns Backup gshadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/gshadow- is owned by 0. - - - - - - - - - Verify User Who Owns Backup passwd File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/passwd- is owned by 0. - - - - - - - - - Verify Group Who Owns Backup shadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/shadow- is owned by 0. - - - - - - - - - Verify User Who Owns group File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/group is owned by 0. - - - - - - - - - Verify User Who Owns gshadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/gshadow is owned by 0. - - - - - - - - - Verify ownership of System Login Banner - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/issue is owned by 0. - - - - - - - - - Verify User Who Owns passwd File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/passwd is owned by 0. - - - - - - - - - Verify User Who Owns shadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/shadow is owned by 0. - - - - - - - - - Verify Owner on SSH Server config file - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/ssh/sshd_config is owned by 0. - - - - - - - - - Verify User Who Owns /var/log Directory - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/ is owned by 0. - - - - - - - - - Verify User Who Owns /var/log/messages File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/messages is owned by 0. - - - - - - - - - Verify User Who Owns /var/log/syslog File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/syslog is owned by 104. - - - - - - - - - Audit Configuration Files Must Be Owned By Root - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/audit/, /etc/audit/rules.d/ is owned by 0. - - - - - - - - - - Verify that Shared Library Files Have Root Ownership - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is owned by 0. - - - - - - - - - - - - Verify Permissions on Backup group File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/group- has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on Backup gshadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/gshadow- has mode 0000. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on Backup passwd File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/passwd- has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on Backup shadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/shadow- has mode 0000. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on group File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/group has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on gshadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/gshadow has mode 0000. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify permissions on System Login Banner - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/issue has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on passwd File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/passwd has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on shadow File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/shadow has mode 0000. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify that Shared Library Files Have Restrictive Permissions - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ has mode 7755. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - - - - Verify Permissions on SSH Server config file - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/ssh/sshd_config has mode 0600. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on SSH Server Public *.pub Key Files - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /etc/ssh/ has mode 0644. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on /var/log Directory - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/ has mode 0755. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on /var/log/messages File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/messages has mode 0640. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - Verify Permissions on /var/log/syslog File - - Red Hat Enterprise Linux CoreOS 4 - - This test makes sure that /var/log/syslog has mode 0640. - If the target file or directory has an extended ACL, then it will fail the mode check. - - - - - - - - - - IOMMU configuration directive - - Red Hat Enterprise Linux CoreOS 4 - - Ensure iommu=force is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Ensure IPv6 is disabled through kernel boot parameter - - Red Hat Enterprise Linux CoreOS 4 - - Ensure ipv6.disable=1 is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Configure L1 Terminal Fault mitigations - - Red Hat Enterprise Linux CoreOS 4 - - Ensure l1tf is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Force kernel panic on uncorrected MCEs - - Red Hat Enterprise Linux CoreOS 4 - - Ensure mce=0 is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Ensure SMAP is not disabled during boot - - Red Hat Enterprise Linux CoreOS 4 - - Ensure nosmap is not set in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Ensure SMEP is not disabled during boot - - Red Hat Enterprise Linux CoreOS 4 - - Ensure nosmep is not set in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Configure the confidence in TPM for entropy - - Red Hat Enterprise Linux CoreOS 4 - - Ensure rng_core.default_quality is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Disable merging of slabs with similar size - - Red Hat Enterprise Linux CoreOS 4 - - Ensure slab_nomerge=yes is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Configure Speculative Store Bypass Mitigation - - Red Hat Enterprise Linux CoreOS 4 - - Ensure spec_store_bypass_disable is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Enforce Spectre v2 mitigation - - Red Hat Enterprise Linux CoreOS 4 - - Ensure spectre_v2=on is configured in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Ensure debug-shell service is not enabled during boot - - Red Hat Enterprise Linux CoreOS 4 - - Ensure systemd.debug-shell is not set in the kernel line in /etc/default/grub. - - - - - - - - - - - - - - - Do not allow ACPI methods to be inserted/replaced at run time - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_ACPI_CUSTOM_METHOD should have value n - - - - - - - - - - - - - Disable kernel support for MISC binaries - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_BINFMT_MISC should have value n - - - - - - - - - - - - - Enable support for BUG() - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_BUG should have value y - - - - - - - - - - - - Disable compatibility with brk() - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_COMPAT_BRK should have value n - - - - - - - - - - - - - Disable the 32-bit vDSO - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_COMPAT_VDSO should have value n - - - - - - - - - - - - - Enable checks on credential management - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_DEBUG_CREDENTIALS should have value y - - - - - - - - - - - - Disable kernel debugfs - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_DEBUG_FS should have value n - - - - - - - - - - - - - Enable checks on linked list manipulation - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_DEBUG_LIST should have value y - - - - - - - - - - - - Enable checks on notifier call chains - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_DEBUG_NOTIFIERS should have value y - - - - - - - - - - - - Enable checks on scatter-gather (SG) table operations - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_DEBUG_SG should have value y - - - - - - - - - - - - Configure low address space to protect from user allocation - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_DEFAULT_MMAP_MIN_ADDR should have value 65536 - - - - - - - - - - - - Disable /dev/kmem virtual device support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_DEVKMEM should have value n - - - - - - - - - - - - - Disable hibernation - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_HIBERNATION should have value n - - - - - - - - - - - - - Disable IA32 emulation - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_IA32_EMULATION should have value n - - - - - - - - - - - - - Disable the IPv6 protocol - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_IPV6 should have value n - - - - - - - - - - - - - Disable kexec system call - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_KEXEC should have value n - - - - - - - - - - - - - Disable legacy (BSD) PTY support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_LEGACY_PTYS should have value n - - - - - - - - - - - - - Enable module signature verification - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_MODULE_SIG should have value y - - - - - - - - - - - - Enable automatic signing of all modules - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_MODULE_SIG_ALL should have value y - - - - - - - - - - - - Require modules to be validly signed - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_MODULE_SIG_FORCE should have value y - - - - - - - - - - - - Specify the hash to use when signing modules - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_MODULE_SIG_HASH should have value according to var_kernel_config_module_sig_hash - - - - - - - - - - - - Specify module signing key to use - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_MODULE_SIG_KEY should have value according to var_kernel_config_module_sig_key - - - - - - - - - - - - Sign kernel modules with SHA-512 - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_MODULE_SIG_SHA512 should have value y - - - - - - - - - - - - Enable poison without sanity check - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_PAGE_POISONING_NO_SANITY should have value y - - - - - - - - - - - - Use zero for poisoning instead of debugging value - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_PAGE_POISONING_ZERO should have value y - - - - - - - - - - - - Remove the kernel mapping in user mode - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_PAGE_TABLE_ISOLATION should have value y - - - - - - - - - - - - Kernel panic oops - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_PANIC_ON_OOPS should have value y - - - - - - - - - - - - Kernel panic timeout - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_PANIC_TIMEOUT should have value according to var_kernel_config_panic_timeout - - - - - - - - - - - - Disable support for /proc/kkcore - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_PROC_KCORE should have value n - - - - - - - - - - - - - Randomize the address of the kernel image (KASLR) - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_RANDOMIZE_BASE should have value y - - - - - - - - - - - - Randomize the kernel memory sections - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_RANDOMIZE_MEMORY should have value y - - - - - - - - - - - - Avoid speculative indirect branches in kernel - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_RETPOLINE should have value y - - - - - - - - - - - - Enable seccomp to safely compute untrusted bytecode - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SECCOMP should have value y - - - - - - - - - - - - Enable use of Berkeley Packet Filter with seccomp - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SECCOMP_FILTER should have value y - - - - - - - - - - - - Enable different security models - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SECURITY should have value y - - - - - - - - - - - - Restrict unprivileged access to the kernel syslog - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SECURITY_DMESG_RESTRICT should have value n - - - - - - - - - - - - - Disable mutable hooks - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SECURITY_WRITABLE_HOOKS should have value y - - - - - - - - - - - - Enable Yama support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SECURITY_YAMA should have value y - - - - - - - - - - - - Enable SLUB debugging support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SLUB_DEBUG should have value y - - - - - - - - - - - - Enable TCP/IP syncookie support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_SYN_COOKIES should have value y - - - - - - - - - - - - Unmap kernel when running in userspace (aka KAISER) - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_UNMAP_KERNEL_AT_EL0 should have value y - - - - - - - - - - - - Disable x86 vsyscall emulation - - Red Hat Enterprise Linux CoreOS 4 - - The kernel CONFIG_X86_VSYSCALL_EMULATION should have value n - - - - - - - - - - - - - Disable ATM Support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module atm should be disabled. - - - - - - - - - - - - - - Disable Bluetooth Kernel Module - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module bluetooth should be disabled. - - - - - - - - - - - - - - Disable CAN Support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module can should be disabled. - - - - - - - - - - - - - - Disable Kernel cfg80211 Module - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module cfg80211 should be disabled. - - - - - - - - - - - - - - Disable Mounting of cramfs - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module cramfs should be disabled. - - - - - - - - - - - - - - Disable IEEE 1394 (FireWire) Support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module firewire-core should be disabled. - - - - - - - - - - - - - - Disable Mounting of freevxfs - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module freevxfs should be disabled. - - - - - - - - - - - - - - Disable Mounting of hfs - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module hfs should be disabled. - - - - - - - - - - - - - - Disable Mounting of hfsplus - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module hfsplus should be disabled. - - - - - - - - - - - - - - Disable Kernel iwlmvm Module - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module iwlmvm should be disabled. - - - - - - - - - - - - - - Disable Kernel iwlwifi Module - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module iwlwifi should be disabled. - - - - - - - - - - - - - - Disable Mounting of jffs2 - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module jffs2 should be disabled. - - - - - - - - - - - - - - Disable Kernel mac80211 Module - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module mac80211 should be disabled. - - - - - - - - - - - - - - Disable RDS Support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module rds should be disabled. - - - - - - - - - - - - - Disable SCTP Support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module sctp should be disabled. - - - - - - - - - - - - - - Disable Mounting of squashfs - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module squashfs should be disabled. - - - - - - - - - - - - - - Disable TIPC Support - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module tipc should be disabled. - - - - - - - - - - - - - - Disable Mounting of udf - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module udf should be disabled. - - - - - - - - - - - - - - Disable Modprobe Loading of USB Storage Driver - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module usb-storage should be disabled. - - - - - - - - - - - - - - Disable the uvcvideo module - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module uvcvideo should be disabled. - - - - - - - - - - - - - Disable Mounting of vFAT filesystems - - Red Hat Enterprise Linux CoreOS 4 - - The kernel module vfat should be disabled. - - - - - - - - - - - - - - Add nodev Option to /boot - - Red Hat Enterprise Linux CoreOS 4 - - /boot should be mounted with mount option nodev. - - - - - - - - - Add nosuid Option to /boot - - Red Hat Enterprise Linux CoreOS 4 - - /boot should be mounted with mount option nosuid. - - - - - - - - - Add nodev Option to /dev/shm - - Red Hat Enterprise Linux CoreOS 4 - - /dev/shm should be mounted with mount option nodev. - - - - - - - - - - - Add noexec Option to /dev/shm - - Red Hat Enterprise Linux CoreOS 4 - - /dev/shm should be mounted with mount option noexec. - - - - - - - - - - - Add nosuid Option to /dev/shm - - Red Hat Enterprise Linux CoreOS 4 - - /dev/shm should be mounted with mount option nosuid. - - - - - - - - - - - Add nodev Option to /home - - Red Hat Enterprise Linux CoreOS 4 - - /home should be mounted with mount option nodev. - - - - - - - - - - Add nosuid Option to /home - - Red Hat Enterprise Linux CoreOS 4 - - /home should be mounted with mount option nosuid. - - - - - - - - - Add nodev Option to Removable Media Partitions - - Red Hat Enterprise Linux CoreOS 4 - - The nodev option should be enabled for all removable devices mounts in /etc/fstab. - - - - - - - - - - - - - - - - - - Add noexec Option to Removable Media Partitions - - Red Hat Enterprise Linux CoreOS 4 - - The noexec option should be enabled for all removable devices mounts in /etc/fstab. - - - - - - - - - - - - - - - - - - Add nosuid Option to Removable Media Partitions - - Red Hat Enterprise Linux CoreOS 4 - - The nosuid option should be enabled for all removable devices mounts in /etc/fstab. - - - - - - - - - - - - - - - - - - Add nodev Option to /tmp - - Red Hat Enterprise Linux CoreOS 4 - - /tmp should be mounted with mount option nodev. - - - - - - - - - Add noexec Option to /tmp - - Red Hat Enterprise Linux CoreOS 4 - - /tmp should be mounted with mount option noexec. - - - - - - - - - Add nosuid Option to /tmp - - Red Hat Enterprise Linux CoreOS 4 - - /tmp should be mounted with mount option nosuid. - - - - - - - - - Add nodev Option to /var/log/audit - - Red Hat Enterprise Linux CoreOS 4 - - /var/log/audit should be mounted with mount option nodev. - - - - - - - - - Add noexec Option to /var/log/audit - - Red Hat Enterprise Linux CoreOS 4 - - /var/log/audit should be mounted with mount option noexec. - - - - - - - - - Add nosuid Option to /var/log/audit - - Red Hat Enterprise Linux CoreOS 4 - - /var/log/audit should be mounted with mount option nosuid. - - - - - - - - - Add nodev Option to /var/log - - Red Hat Enterprise Linux CoreOS 4 - - /var/log should be mounted with mount option nodev. - - - - - - - - - Add noexec Option to /var/log - - Red Hat Enterprise Linux CoreOS 4 - - /var/log should be mounted with mount option noexec. - - - - - - - - - Add nosuid Option to /var/log - - Red Hat Enterprise Linux CoreOS 4 - - /var/log should be mounted with mount option nosuid. - - - - - - - - - Add nodev Option to /var - - Red Hat Enterprise Linux CoreOS 4 - - /var should be mounted with mount option nodev. - - - - - - - - - Add nosuid Option to /var - - Red Hat Enterprise Linux CoreOS 4 - - /var should be mounted with mount option nosuid. - - - - - - - - - Add nodev Option to /var/tmp - - Red Hat Enterprise Linux CoreOS 4 - - /var/tmp should be mounted with mount option nodev. - - - - - - - - - - Add noexec Option to /var/tmp - - Red Hat Enterprise Linux CoreOS 4 - - /var/tmp should be mounted with mount option noexec. - - - - - - - - - - Add nosuid Option to /var/tmp - - Red Hat Enterprise Linux CoreOS 4 - - /var/tmp should be mounted with mount option nosuid. - - - - - - - - - - package_GConf2_installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package GConf2 should be installed. - - - - - - - - - Install the Host Intrusion Prevention System (HIPS) Module - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package MFEhiplsm should be installed. - - - - - - - - - Install AIDE - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package aide should be installed. - - - - - - - - - Install audispd-plugins Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package audispd-plugins should be installed. - - - - - - - - - Ensure the default plugins for the audit dispatcher are Installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package audit-audispd-plugins should be installed. - - - - - - - - - Ensure the audit Subsystem is Installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package audit should be installed. - - - - - - - - - - package_avahi_installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package avahi should be installed. - - - - - - - - - Uninstall bind Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package bind should be removed. - - - - - - - - - The Chrony package is installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package chrony should be installed. - - - - - - - - - Install the cron service - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package cron should be installed. - - - - - - - - - package_dconf_installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package dconf should be installed. - - - - - - - - - package_esc_installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package esc should be installed. - - - - - - - - - Install fapolicyd Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package fapolicyd should be installed. - - - - - - - - - - Install firewalld Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package firewalld should be installed. - - - - - - - - - - package_gdm_installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package gdm should be installed. - - - - - - - - - Ensure gnutls-utils is installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package gnutls-utils should be installed. - - - - - - - - - Uninstall the inet-based telnet server - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package inetutils-telnetd should be removed. - - - - - - - - - Install iptables Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package iptables should be installed. - - - - - - - - - - Install libreswan Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package libreswan should be installed. - - - - - - - - - - Install libselinux Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package libselinux should be installed. - - - - - - - - - Uninstall net-snmp Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package net-snmp should be removed. - - - - - - - - - Uninstall the nis package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package nis should be removed. - - - - - - - - - Ensure nss-tools is installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package nss-tools should be installed. - - - - - - - - - Install the ntp service - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package ntp should be installed. - - - - - - - - - Uninstall the ntpdate package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package ntpdate should be removed. - - - - - - - - - Ensure LDAP client is not installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package openldap-clients should be removed. - - - - - - - - - Install the OpenSSH Server Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package openssh-server should be installed. - - - - - - - - - Remove the OpenSSH Server Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package openssh-server should be removed. - - - - - - - - - package_pam_ldap_removed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package pam_ldap should be removed. - - - - - - - - - The Postfix package is installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package postfix should be installed. - - - - - - - - - package_prelink_removed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package prelink should be removed. - - - - - - - - - Ensure rsyslog is Installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package rsyslog should be installed. - - - - - - - - - Install the Samba Common Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package samba-common should be installed. - - - - - - - - - package_samba-common_removed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package samba-common should be removed. - - - - - - - - - Uninstall Sendmail Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package sendmail should be removed. - - - - - - - - - Uninstall setroubleshoot-plugins Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package setroubleshoot-plugins should be removed. - - - - - - - - - - Uninstall setroubleshoot-server Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package setroubleshoot-server should be removed. - - - - - - - - - - Install sudo Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package sudo should be installed. - - - - - - - - - - Ensure syslog-ng is Installed - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package syslog-ng should be installed. - - - - - - - - - Uninstall the ssl compliant telnet server - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package telnetd-ssl should be removed. - - - - - - - - - Uninstall the telnet server - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package telnetd should be removed. - - - - - - - - - Install the tmux Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package tmux should be installed. - - - - - - - - - Install usbguard Package - - Red Hat Enterprise Linux CoreOS 4 - - The RPM package usbguard should be installed. - - - - - - - - - - Ensure /home Located On Separate Partition - - Red Hat Enterprise Linux CoreOS 4 - - If stored locally, create a separate partition for - . If will be mounted from another - system such as an NFS server, then creating a separate partition is not - necessary at this time, and the mountpoint can instead be configured - later. - - - - - - - - - - Ensure /srv Located On Separate Partition - - Red Hat Enterprise Linux CoreOS 4 - - If stored locally, create a separate partition for - . If will be mounted from another - system such as an NFS server, then creating a separate partition is not - necessary at this time, and the mountpoint can instead be configured - later. - - - - - - - - - Ensure /tmp Located On Separate Partition - - Red Hat Enterprise Linux CoreOS 4 - - If stored locally, create a separate partition for - . If will be mounted from another - system such as an NFS server, then creating a separate partition is not - necessary at this time, and the mountpoint can instead be configured - later. - - - - - - - - - Ensure /var Located On Separate Partition - - Red Hat Enterprise Linux CoreOS 4 - - If stored locally, create a separate partition for - . If will be mounted from another - system such as an NFS server, then creating a separate partition is not - necessary at this time, and the mountpoint can instead be configured - later. - - - - - - - - - Ensure /var/tmp Located On Separate Partition - - Red Hat Enterprise Linux CoreOS 4 - - If stored locally, create a separate partition for - . If will be mounted from another - system such as an NFS server, then creating a separate partition is not - necessary at this time, and the mountpoint can instead be configured - later. - - - - - - - - - - Enable auditd Service - - Red Hat Enterprise Linux CoreOS 4 - - The auditd service should be enabled if possible. - - - - - - - - - - - - - - - - - Disable the Automounter - - Red Hat Enterprise Linux CoreOS 4 - - The autofs service should be disabled if possible. - - - - - - - - - - - - - - Disable Bluetooth Service - - Red Hat Enterprise Linux CoreOS 4 - - The bluetooth service should be disabled if possible. - - - - - - - - - - - - - The Chronyd service is enabled - - Red Hat Enterprise Linux CoreOS 4 - - The chronyd service should be enabled if possible. - - - - - - - - - - - - - - - - Enable cron Service - - Red Hat Enterprise Linux CoreOS 4 - - The cron service should be enabled if possible. - - - - - - - - - - - - - - - - Disable debug-shell SystemD Service - - Red Hat Enterprise Linux CoreOS 4 - - The debug-shell service should be disabled if possible. - - - - - - - - - - - - - - Enable the File Access Policy Service - - Red Hat Enterprise Linux CoreOS 4 - - The fapolicyd service should be enabled if possible. - - - - - - - - - - - - - - - - - Verify firewalld Enabled - - Red Hat Enterprise Linux CoreOS 4 - - The firewalld service should be enabled if possible. - - - - - - - - - - - - - - - - - Verify ip6tables Enabled if Using IPv6 - - Red Hat Enterprise Linux CoreOS 4 - - The ip6tables service should be enabled if possible. - - - - - - - - - - - - - - - - Verify iptables Enabled - - Red Hat Enterprise Linux CoreOS 4 - - The iptables service should be enabled if possible. - - - - - - - - - - - - - - - - Disable Network File Systems (netfs) - - Red Hat Enterprise Linux CoreOS 4 - - The netfs service should be disabled if possible. - - - - - - - - - - - - - Enable the NTP Daemon - - Red Hat Enterprise Linux CoreOS 4 - - The ntp service should be enabled if possible. - - - - - - - - - - - - - - - - Enable the NTP Daemon - - Red Hat Enterprise Linux CoreOS 4 - - The ntpd service should be enabled if possible. - - - - - - - - - - - - - - - - Enable the Hardware RNG Entropy Gatherer Service - - Red Hat Enterprise Linux CoreOS 4 - - The rngd service should be enabled if possible. - - - - - - - - - - - - - - - - - Enable rsyslog Service - - Red Hat Enterprise Linux CoreOS 4 - - The rsyslog service should be enabled if possible. - - - - - - - - - - - - - - - - Disable SSH Server If Possible (Unusual) - - Red Hat Enterprise Linux CoreOS 4 - - The sshd service should be disabled if possible. - - - - - - - - - - - - - service_syslog_disabled - - Red Hat Enterprise Linux CoreOS 4 - - The syslog service should be disabled if possible. - - - - - - - - - - - - - Enable syslog-ng Service - - Red Hat Enterprise Linux CoreOS 4 - - The syslog-ng service should be enabled if possible. - - - - - - - - - - - - - - - - Disable acquiring, saving, and processing core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The systemd-coredump service should be disabled if possible. - - - - - - - - - - - - - - Enable systemd-journald Service - - Red Hat Enterprise Linux CoreOS 4 - - The systemd-journald service should be enabled if possible. - - - - - - - - - - - - - - - - Verify ufw Enabled - - Red Hat Enterprise Linux CoreOS 4 - - The ufw service should be enabled if possible. - - - - - - - - - - - - - - - - Enable the USBGuard Service - - Red Hat Enterprise Linux CoreOS 4 - - The usbguard service should be enabled if possible. - - - - - - - - - - - - - - - - - Disable SSH Access via Empty Passwords - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'PermitEmptyPasswords' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable GSSAPI Authentication - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'GSSAPIAuthentication' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable Kerberos Authentication - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'KerberosAuthentication' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable PubkeyAuthentication Authentication - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'PubkeyAuthentication' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable SSH Support for .rhosts Files - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'IgnoreRhosts' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - - Disable SSH Root Login - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'PermitRootLogin' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable SSH root Login with a Password (Insecure) - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'PermitRootLogin' is configured with value 'prohibit-password' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable SSH TCP Forwarding - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'AllowTcpForwarding' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable SSH Support for User Known Hosts - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'IgnoreUserKnownHosts' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Disable X11 Forwarding - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'X11Forwarding' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Do Not Allow SSH Environment Options - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'PermitUserEnvironment' is configured with value 'no' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Enable GSSAPI Authentication - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'GSSAPIAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Enable PAM - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'UsePAM' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Enable Public Key Authentication - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'PubkeyAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Enable Use of Strict Mode Checking - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'StrictModes' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Enable SSH Warning Banner - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'Banner' is configured with value '/etc/issue' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Enable SSH Warning Banner - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'Banner' is configured with value '/etc/issue.net' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Enable Encrypted X11 Forwarding - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'X11Forwarding' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - sshd_includes_config_files - - Red Hat Enterprise Linux CoreOS 4 - - Check presence of Include /etc/ssh/sshd_config.d/*.conf in /etc/ssh/sshd_config - - - - - - - - - Enable SSH Print Last Log - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'PrintLastLog' is configured with value 'yes' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Set SSH Client Alive Count Max to zero - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'ClientAliveCountMax' is configured with value '0' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - - Set LogLevel to INFO - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'LogLevel' is configured with value 'INFO' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Set SSH Daemon LogLevel to VERBOSE - - Red Hat Enterprise Linux CoreOS 4 - - Ensure 'LogLevel' is configured with value 'VERBOSE' in /etc/ssh/sshd_config - - - - - - - - - - - - - - - - - - - Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudoers Defaults {{ OPTION }} configuration - - - - - - - - - Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudoers Defaults {{ OPTION }} configuration - - - - - - - - - Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudoers Defaults {{ OPTION }} configuration - - - - - - - - - Ensure Sudo Logfile Exists - sudo logfile - - Red Hat Enterprise Linux CoreOS 4 - - Checks sudoers Defaults {{ OPTION }} configuration - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Hardlinks - - Red Hat Enterprise Linux CoreOS 4 - - The 'fs.protected_hardlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Hardlinks - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system runtime. - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Hardlinks - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Symlinks - - Red Hat Enterprise Linux CoreOS 4 - - The 'fs.protected_symlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Symlinks - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system runtime. - - - - - - - - - Enable Kernel Parameter to Enforce DAC on Symlinks - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Disable Core Dumps for SUID programs - - Red Hat Enterprise Linux CoreOS 4 - - The 'fs.suid_dumpable' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Disable Core Dumps for SUID programs - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system runtime. - - - - - - - - - Disable Core Dumps for SUID programs - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Disable storing core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.core_pattern' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable storing core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.core_pattern' parameter should be set to | or / or b or i or n or / or f or a or l or s or e in the system runtime. - - - - - - - - - Disable storing core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.core_pattern' parameter should be set to | or / or b or i or n or / or f or a or l or s or e in the system configuration. - - - - - - - - - - - - - - Disable storing core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.core_pattern' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Disable storing core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.core_pattern' parameter should be set to ' or ' in the system runtime. - - - - - - - - - Disable storing core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.core_pattern' parameter should be set to ' or ' in the system configuration. - - - - - - - - - - - - - - Configure file name of core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.core_uses_pid' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Configure file name of core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.core_uses_pid' parameter should be set to 0 in the system runtime. - - - - - - - - - Configure file name of core dumps - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.core_uses_pid' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Restrict Access to Kernel Message Buffer - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.dmesg_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Restrict Access to Kernel Message Buffer - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system runtime. - - - - - - - - - Restrict Access to Kernel Message Buffer - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Disable Kernel Image Loading - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.kexec_load_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Kernel Image Loading - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system runtime. - - - - - - - - - Disable Kernel Image Loading - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Restrict Exposed Kernel Pointer Addresses Access - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.kptr_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Restrict Exposed Kernel Pointer Addresses Access - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.kptr_restrict' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Restrict Exposed Kernel Pointer Addresses Access - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.kptr_restrict' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Kernel panic on oops - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.panic_on_oops' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Kernel panic on oops - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system runtime. - - - - - - - - - Kernel panic on oops - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Disallow kernel profiling by unprivileged users - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.perf_event_paranoid' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disallow kernel profiling by unprivileged users - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system runtime. - - - - - - - - - Disallow kernel profiling by unprivileged users - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system configuration. - - - - - - - - - - - - - - Enable Randomized Layout of Virtual Address Space - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.randomize_va_space' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Enable Randomized Layout of Virtual Address Space - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system runtime. - - - - - - - - - Enable Randomized Layout of Virtual Address Space - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system configuration. - - - - - - - - - - - - - - Disable Access to Network bpf() Syscall From Unprivileged Processes - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.unprivileged_bpf_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Access to Network bpf() Syscall From Unprivileged Processes - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system runtime. - - - - - - - - - Disable Access to Network bpf() Syscall From Unprivileged Processes - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Restrict usage of ptrace to descendant processes - - Red Hat Enterprise Linux CoreOS 4 - - The 'kernel.yama.ptrace_scope' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Restrict usage of ptrace to descendant processes - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system runtime. - - - - - - - - - Restrict usage of ptrace to descendant processes - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Harden the operation of the BPF just-in-time compiler - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.core.bpf_jit_harden' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Harden the operation of the BPF just-in-time compiler - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system runtime. - - - - - - - - - Harden the operation of the BPF just-in-time compiler - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system configuration. - - - - - - - - - - - - - - Disable Accepting Packets Routed Between Local Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.accept_local' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Disable Accepting Packets Routed Between Local Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system runtime. - - - - - - - - - Disable Accepting Packets Routed Between Local Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Disable Accepting ICMP Redirects for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Accepting ICMP Redirects for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Accepting ICMP Redirects for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Configure ARP filtering for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.arp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Configure ARP filtering for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Configure ARP filtering for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Configure Response Mode of ARP Requests for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.arp_ignore' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Configure Response Mode of ARP Requests for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Configure Response Mode of ARP Requests for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.route_localnet' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system runtime. - - - - - - - - - Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system runtime. - - - - - - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.all.shared_media' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.default.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.default.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.default.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.default.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Configure Kernel Parameter for Accepting Secure Redirects By Default - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.default.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Configure Kernel Parameter for Accepting Secure Redirects By Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Configure Kernel Parameter for Accepting Secure Redirects By Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.default.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system runtime. - - - - - - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Configure Sending and Accepting Shared Media Redirects by Default - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.conf.default.shared_media' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Configure Sending and Accepting Shared Media Redirects by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Configure Sending and Accepting Shared Media Redirects by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.icmp_ignore_bogus_error_responses' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.ip_forward' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system runtime. - - - - - - - - - Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.tcp_invalid_ratelimit' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.tcp_invalid_ratelimit' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.tcp_invalid_ratelimit' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'net.ipv4.tcp_syncookies' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Configure Accepting Router Advertisements on All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_ra' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - - Configure Accepting Router Advertisements on All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_ra' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Configure Accepting Router Advertisements on All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_ra' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Accepting ICMP Redirects for All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_redirects' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - - Disable Accepting ICMP Redirects for All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_redirects' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Accepting ICMP Redirects for All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_redirects' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_source_route' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_source_route' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.accept_source_route' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable IPv6 Addressing on All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - Disable IPv6 Addressing on All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system runtime. - - - - - - - - - Disable IPv6 Addressing on All IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_source_route' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_source_route' parameter should be set to the appropriate value in the system runtime. - - - - - - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.accept_source_route' parameter should be set to the appropriate value in the system configuration. - - - - - - - - - - - - - - Disable IPv6 Addressing on IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - - - Disable IPv6 Addressing on IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system runtime. - - - - - - - - - Disable IPv6 Addressing on IPv6 Interfaces by Default - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system configuration. - - - - - - - - - - - - - - Disable the use of user namespaces - - Red Hat Enterprise Linux CoreOS 4 - - The 'user.max_user_namespaces' kernel parameter should be set to the appropriate value in both system configuration and system runtime. - - - - - - - - - - - Disable the use of user namespaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system runtime. - - - - - - - - - Disable the use of user namespaces - - Red Hat Enterprise Linux CoreOS 4 - - The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system configuration. - - - - - - - - - - - - - - Enable Auditing to Start Prior to the Audit Daemon in zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Ensure audit=1 option is configured in the 'options' line in /boot/loader/entries/*.conf. Make sure that newly installed kernels will retain this option, it should be configured in /etc/kernel/cmdline as well. - - - - - - - - - - Extend Audit Backlog Limit for the Audit Daemon in zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Ensure audit_backlog_limit=8192 option is configured in the 'options' line in /boot/loader/entries/*.conf. Make sure that newly installed kernels will retain this option, it should be configured in /etc/kernel/cmdline as well. - - - - - - - - - - Enable page allocator poisoning in zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Ensure page_poison=1 option is configured in the 'options' line in /boot/loader/entries/*.conf. Make sure that newly installed kernels will retain this option, it should be configured in /etc/kernel/cmdline as well. - - - - - - - - - - Enable SLUB/SLAB allocator poisoning in zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Ensure slub_debug=P option is configured in the 'options' line in /boot/loader/entries/*.conf. Make sure that newly installed kernels will retain this option, it should be configured in /etc/kernel/cmdline as well. - - - - - - - - - - Disable vsyscalls in zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Ensure vsyscall=none option is configured in the 'options' line in /boot/loader/entries/*.conf. Make sure that newly installed kernels will retain this option, it should be configured in /etc/kernel/cmdline as well. - - - - - - - - - - Check pam_faillock Existence in system-auth - - Red Hat Enterprise Linux CoreOS 4 - - Check that pam_faillock.so exists in system-auth - - - - - - - - - Check pam_pwquality Existence in system-auth - - Red Hat Enterprise Linux CoreOS 4 - - Check that pam_pwquality.so exists in system-auth - - - - - - - - - Record Any Attempts to Run semanage - - Red Hat Enterprise Linux CoreOS 4 - - Test if auditctl is in use for audit rules. - - - - - - - - - Record Any Attempts to Run semanage - - Red Hat Enterprise Linux CoreOS 4 - - Test if augenrules is enabled for audit rules. - - - - - - - - - Record Events that Modify the System's Network Environment - - Red Hat Enterprise Linux CoreOS 4 - - The network environment should not be modified by anything other than - administrator action. Any change to network parameters should be audited. - - - - - - - - - - - - - - - - - - - - - - - - Record Events that Modify the System's Network Environment - - Red Hat Enterprise Linux CoreOS 4 - - The network environment should not be modified by anything other than - administrator action. Any change to network parameters should be audited. - - - - - - - - - - - - - - - - - - - - - - - - 'log_file' Not Set In /etc/audit/auditd.conf - - Red Hat Enterprise Linux CoreOS 4 - - Verify 'log_file' is not set in /etc/audit/auditd.conf. - - - - - - - - - 'log_group' Not Set To 'root' In /etc/audit/auditd.conf - - Red Hat Enterprise Linux CoreOS 4 - - Verify 'log_group' is not set to 'root' in - /etc/audit/auditd.conf. - - - - - - - - - - Verify GRUB_DISABLE_RECOVERY Set to true - - Red Hat Enterprise Linux CoreOS 4 - - GRUB_DISABLE_RECOVERY set to 'true' in - /etc/default/grub - - - - - - - - - Specify Multiple Remote chronyd NTP Servers for Time Data - - Red Hat Enterprise Linux CoreOS 4 - - Multiple chronyd NTP Servers for time synchronization should be specified. - - - - - - - - - GRUB_CMDLINE_LINUX_DEFAULT existance check - - Red Hat Enterprise Linux CoreOS 4 - - Check if GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub. - - - - - - - - - Use $kernelopts in /boot/loader/entries/*.conf - - Red Hat Enterprise Linux CoreOS 4 - - Ensure that grubenv-defined kernel options are referenced in individual boot loader entries - - - - - - - - - Install McAfee Host-Based Intrusion Detection Software (HBSS) - - Red Hat Enterprise Linux CoreOS 4 - - McAfee Host-Based Intrusion Detection Software (HBSS) software - should be installed. - - - - - - - - - - - - Alibaba Cloud Linux 2 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Alibaba Cloud Linux 2 - - - - - - - - - - Alibaba Cloud Linux 3 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Alibaba Cloud Linux 3 - - - - - - - - - - CentOS 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - CentOS 7 - - - - - - - - - - CentOS 8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - CentOS 8 - - - - - - - - - - - CentOS Stream 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - CentOS Stream 9 - - - - - - - - - - - Debian - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed is a Debian System - - - - - - - - - - Debian Linux 10 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Debian 10 - - - - - - - - - - Debian Linux 11 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Debian 11 - - - - - - - - - - Debian 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Debian 9 - - - - - - - - - - Installed operating system is Fedora - - Red Hat Enterprise Linux CoreOS 4 - - - - - - The operating system installed on the system is Fedora - - - - - - - - - - - Oracle Linux 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Oracle Linux 7 - - - - - - - - - - - - Oracle Linux 8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Oracle Linux 8 - - - - - - - - - - - - Oracle Linux 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Oracle Linux 9 - - - - - - - - - - - - openSUSE - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed on the system is openSUSE. - - - - - - - - - - openSUSE Leap 15 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is openSUSE Leap 15. - - - - - - - - - - openSUSE Leap 42 - - Red Hat Enterprise Linux CoreOS 4 - - - - - The operating system installed on the system is openSUSE Leap 42. - - - - - - - - - - Installed operating system is part of the Unix family - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed on the system is part of the Unix OS family - - - - - - - - - Red Hat Enterprise Linux CoreOS - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux CoreOS release 4 - - - - - - - - - - - - Red Hat Enterprise Linux 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux 7 - - - - - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux 8 - - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8.0 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.0 - - - - - - - - - Red Hat Enterprise Linux 8.1 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.1 - - - - - - - - - Red Hat Enterprise Linux 8.2 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.2 - - - - - - - - - Red Hat Enterprise Linux 8.3 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.3 - - - - - - - - - Red Hat Enterprise Linux 8.4 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.4 - - - - - - - - - Red Hat Enterprise Linux 8.5 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.5 - - - - - - - - - Red Hat Enterprise Linux 8.6 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.6 - - - - - - - - - Red Hat Enterprise Linux 8.7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.7 - - - - - - - - - Red Hat Enterprise Linux 8.8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.8 - - - - - - - - - Red Hat Enterprise Linux 8.9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.9 - - - - - - - - - Red Hat Enterprise Linux 8.10 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.10 - - - - - - - - - Red Hat Enterprise Linux 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux 9 - - - - - - - - - - - - - - - - Red Hat Virtualization 4 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host. - - - - - - - - - - Scientific Linux 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Scientific Linux 7 - - - - - - - - - - SUSE Linux Enterprise 12 - - Red Hat Enterprise Linux CoreOS 4 - - - - The operating system installed on the system is - SUSE Linux Enterprise 12. - - - - - - - - - - - - - - SUSE Linux Enterprise 15 - - Red Hat Enterprise Linux CoreOS 4 - - - - The operating system installed on the system is - SUSE Linux Enterprise 15. - - - - - - - - - - - - - - Ubuntu - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed is an Ubuntu System - - - - - - - - - - - Ubuntu 1604 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Ubuntu 1604 - - - - - - - - - - Ubuntu 1804 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Ubuntu 1804 - - - - - - - - - - Ubuntu 2004 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Ubuntu 2004 - - - - - - - - - - UnionTech OS Server 20 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is UnionTech OS Server 20 - - - - - - - - - - Red Hat Virtualization 4 - - Red Hat Enterprise Linux CoreOS 4 - - - The application installed installed on the system is - Red Hat Virtualization 4. - - - - - - - - - - Package audit is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package audit is installed. - - - - - - - - - - Package chrony is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package chrony is installed. - - - - - - - - - - Package gdm is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package gdm is installed. - - - - - - - - - - Package grub2 is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package grub2-common is installed. - - - - - - - - - - - - - - Package libuser is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package libuser is installed. - - - - - - - - - - Package providing /etc/login.defs is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package providing /etc/login.defs and is installed. - - - - - - - - - - Package net-snmp is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package net-snmp is installed. - - - - - - - - - - Check if the system doesn't act as an oVirt host or manager - - Red Hat Enterprise Linux CoreOS 4 - - Check if the system has neither ovirt-host nor ovirt-engine installed. - - - - - - - - - Package nss-pam-ldapd is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package nss-pam-ldapd is installed. - - - - - - - - - - Package ntp is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package ntp is installed. - - - - - - - - - - Check if the system acts as an oVirt host or manager - - Red Hat Enterprise Linux CoreOS 4 - - Check if the system has ovirt-host or ovirt-engine installed - - - - - - - - - - - Package pam is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package pam is installed. - - - - - - - - - - Package polkit is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package polkit is installed. - - - - - - - - - - Package postfix is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package postfix is installed. - - - - - - - - - - Package sssd-common is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package sssd-common is installed. - - - - - - - - - - Package sudo is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package sudo is installed. - - - - - - - - - - Package systemd is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package systemd is installed. - - - - - - - - - - Package tftp-server is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package tftp-server is installed. - - - - - - - - - - Package tmux is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package tmux is installed. - - - - - - - - - - Package usbguard is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package usbguard is installed. - - - - - - - - - - WiFi interface is present - - Red Hat Enterprise Linux CoreOS 4 - - Checks if any wifi interface is present. - - - - - - - - - - Package yum is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package yum is installed. - - - - - - - - - - System uses zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Checks if system uses zIPL bootloader. - - - - - - - - - - Check if the scan target is a container - - Red Hat Enterprise Linux CoreOS 4 - - Check for presence of files characterizing container filesystems. - - - - - - - - - - - Check if the scan target is a machine - - Red Hat Enterprise Linux CoreOS 4 - - Check for absence of files characterizing container filesystems. - - - - - - - - - - Kerberos server is older than 1.17-18 - - Red Hat Enterprise Linux CoreOS 4 - - - Check if version of Kerberos server is lesser than 1.17-18 - - - - - - - - - - Kerberos workstation is older than 1.17-18 - - Red Hat Enterprise Linux CoreOS 4 - - - Check if version of Kerberos workstation is lesser than 1.17-18 - - - - - - - - - - No CD/DVD drive is configured to automount in /etc/fstab - - Red Hat Enterprise Linux CoreOS 4 - - Check the /etc/fstab and check if a CD/DVD drive - is not configured for automount. - - - - - - - - - Test that the architecture is aarch64 - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64 - - - - - - - - - Test for different architecture than aarch64 - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64 - - - - - - - - - Test for different architecture than s390x - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x - - - - - - - - - Test that the architecture is ppc64le - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is ppc64le - - - - - - - - - Test that the architecture is s390x - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x - - - - - - - - - Device Files for Removable Media Partitions Does Not Exist on the System - - Red Hat Enterprise Linux CoreOS 4 - - Verify if device file representing removable partitions - exist on the system - - - - - - - - - SSHD is not required to be installed or requirement not set - - Red Hat Enterprise Linux CoreOS 4 - - If SSHD is not required, we check it is not installed. If SSH requirement is unset, we are good. - - - - - - - - - - SSHD is required to be installed or requirement not set - - Red Hat Enterprise Linux CoreOS 4 - - If SSHD is required, we check it is installed. If SSH requirement is unset, we are good. - - - - - - - - - - It doesn't matter if sshd is installed or not - - Red Hat Enterprise Linux CoreOS 4 - - Test if value sshd_required is 0. - - - - - - - - - OpenSSH Server is 7.4 or newer - - Red Hat Enterprise Linux CoreOS 4 - - Check if version of OpenSSH Server is equal or higher than 7.4 - - - - - - - - - SSSD is configured to use LDAP - - Red Hat Enterprise Linux CoreOS 4 - - Identification provider is not set to ad within /etc/sssd/sssd.conf - - - - - - - - - - Kernel Runtime Parameter IPv6 Check - - Red Hat Enterprise Linux CoreOS 4 - - Disables IPv6 for all network interfaces. - - - - - - - - - - - - Non-UEFI system boot mode check - - Red Hat Enterprise Linux CoreOS 4 - - Check if System boot mode is non-UEFI. - - - - - - - - - - UEFI system boot mode check - - Red Hat Enterprise Linux CoreOS 4 - - Check if system boot mode is UEFI. - - - - - - - - - - Test for 64-bit Architecture - - Red Hat Enterprise Linux CoreOS 4 - - Generic test for 64-bit architectures to be used by other tests - - - - - - - - - - - - Test for aarch_64 Architecture - - Red Hat Enterprise Linux CoreOS 4 - - Generic test for aarch_64 architecture to be used by other tests - - - - - - - - - Test for PPC and PPCLE Architecture - - Red Hat Enterprise Linux CoreOS 4 - - Generic test for PPC PPC64LE architecture to be used by other tests - - - - - - - - - - Test for s390_64 Architecture - - Red Hat Enterprise Linux CoreOS 4 - - Generic test for s390_64 architecture to be used by other tests - - - - - - - - - Test for x86 Architecture - - Red Hat Enterprise Linux CoreOS 4 - - Generic test for x86 architecture to be used by other tests - - - - - - - - - Test for x86_64 Architecture - - Red Hat Enterprise Linux CoreOS 4 - - Generic test for x86_64 architecture to be used by other tests - - - - - - - - - - - Red Hat Enterprise Linux CoreOS 4 - - Check /etc/tmux.conf is readable by others - - - - - - - - - Check that file storing USBGuard rules exists and is not empty - - Red Hat Enterprise Linux CoreOS 4 - - Check that file storing USBGuard rules at /etc/usbguard/rules.conf exists and is not empty - - - - - - - - - Value of 'var_accounts_user_umask' variable represented as octal number - - Red Hat Enterprise Linux CoreOS 4 - - Value of 'var_accounts_user_umask' variable represented as octal number - - - - - - - - - Value of 'var_removable_partition' variable is set to '/dev/cdrom' - - Red Hat Enterprise Linux CoreOS 4 - - Verify if value of 'var_removable_partition' variable is set - to '/dev/cdrom' - - - - - - - - - Value of 'var_umask_for_daemons' variable represented as octal number - - Red Hat Enterprise Linux CoreOS 4 - - Value of 'var_umask_for_daemons' variable represented as octal number - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^/etc/.+\.keytab$ - - - /etc/aliases - ^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$ - 1 - - - /etc/aliases - ^(?i)postmaster\s*:\s*(.+)$ - 1 - - - /etc/chrony.conf - ^\s*port[\s]+(\S+) - 1 - - - /etc/chrony.conf - ^\s*cmdport[\s]+(\S+) - 1 - - - /etc/ntp.conf - ^server[\s]+[\S]+.*maxpoll[\s]+(\d+) - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^(?:server|pool|peer)[\s]+[\S]+.*maxpoll[\s]+(\d+) - 1 - - - /etc/ntp.conf - ^server[\s]+[\S]+[\s]+(.*) - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^(?:server|pool|peer)[\s]+[\S]+[\s]+(.*) - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^(?:server|pool).* - 1 - - - /etc/ntp.conf - ^server.* - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^[\s]*server.*$ - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^[\s]+pool.*$ - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^[\s]*(?:server|pool)[\s]+.+$ - 1 - - - /etc/ntp.conf - ^([\s]*server[\s]+.+$){2,}$ - 1 - - - /etc/ntp.conf - ^[\s]*server[\s]+.+$ - 1 - - - /root - ^\.rhosts$ - - - - /home - ^\.rhosts$ - - - /etc - ^hosts\.equiv$ - - - /etc/ssh - .*_key$ - oval:ssg-exclude_symlinks__sshd_private_key:ste:1 - oval:ssg-filter_ssh_key_owner_root:ste:1 - oval:ssg-filter_ssh_key_owner_ssh_keys:ste:1 - - - /usr/lib/group - ^ssh_keys:\w+:(\w+):.* - 1 - - - /etc/ssh/ssh_config - ^[\s]*RekeyLimit.*$ - 1 - - - ^/etc/ssh/ssh_config\.d/.*\.conf$ - - 1 - - - /etc/ssh/sshd_config - ^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$ - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)Compression(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:#.*)?$ - 1 - - - /etc/ssh/sshd_config - - 1 - - - /etc/ssh/sshd_config - ^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$ - 1 - - - /etc/ssh/sshd_config - ^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$ - 1 - - - /etc/ssh/sshd_config - ^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$ - 1 - - - /etc/ssh/sshd_config - ^[\s]*(?i)MaxAuthTries[\s]+(\d+)[\s]*(?:#.*)?$ - 1 - - - /etc/ssh/sshd_config - ^[\s]*(?i)MaxSessions[\s]+(\d+)[\s]*(?:#.*)?$ - 1 - - - /etc/ssh/sshd_config - (?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$ - 1 - - - /etc/ssh/sshd_config - (?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$ - 1 - - - /etc/ssh/sshd_config - (?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$ - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)UsePrivilegeSeparation(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/sssd/sssd.conf - ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*(?i)true\s*$ - 1 - - - /etc/sssd/sssd.conf - ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1\s*(?:#.*)?$ - 1 - - - ^/etc/sssd/(sssd|conf\.d/.*)\.conf$ - ^\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*user[ \t]*=[ \t]*(\S*) - 1 - - - /etc/usbguard/usbguard-daemon.conf - ^[ \t]*AuditBackend=(.+?)[ \t]*(?:$|#) - 1 - - - ^/etc/usbguard/usbguard-daemon.conf - - - - ^/etc/issue(\.d/.*)?$ - ^(.*)$ - 1 - - - /etc/pam.d/sudo - ^.*pam_succeed_if.*$ - 1 - - - /etc/pam.d/postlogin - ^\s*session\s+required\s+pam_lastlog\.so(?:\s+[\w=]+)*\s+showfailed(\s|$) - 1 - - - /etc/pam.d/postlogin - ^\s*session\s+.*\s+pam_lastlog\.so(?:\s+[\w=]+)*\s+silent(\s|$) - 1 - - - /etc/pam.d/system-auth - - 1 - - - /etc/pam.d/password-auth - - 1 - - - /etc/security/faillock.conf - ^\s*audit - 1 - - - ^/etc/systemd/system.conf(\.d/.*\.conf)?$ - ^[\s]*CtrlAltDelBurstAction[\s]*=[\s]*none$ - 1 - - - /etc/systemd/system/ctrl-alt-del.target - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(?:.*\s)?systemd\.confirm_spawn(?:=(?:1|yes|true|on))?(?:\s.*)?"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd.confirm_spawn=(?:1|yes|true|on).*$ - 1 - - - /usr/lib/systemd/system/rescue.service - ^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue - 1 - - - /usr/lib/systemd/system/runlevel1.target - ^Requires=.*rescue.service - 1 - - - - /etc/systemd/system - ^rescue.service$ - - - - /etc/systemd/system - ^runlevel1.target$ - - - - ^/etc/bashrc$|^/etc/profile\.d/.*$ - if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi - 1 - - - /etc/tmux.conf - ^\s*set\s+-g\s+lock-after-time\s+(\d+)\s*(?:#.*)?$ - 1 - - - /etc/tmux.conf - ^\s*set\s+-g\s+lock-command\s+vlock\s*(?:#.*)?$ - 1 - - - /etc/shells - tmux\s*$ - 1 - - - /etc/default/useradd - ^\s*INACTIVE\s*=\s*(\d+)\s*$ - 1 - - - /etc/passwd - ^([^:]+):.*$ - 1 - - - oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1 - - - /etc/login.defs - ^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n - 1 - - - oval:ssg-variable_last_pass_max_days_instance_value:var:1 - - - - /etc/login.defs - .*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n - 1 - - - oval:ssg-variable_last_pass_min_days_instance_value:var:1 - - - - /etc/login.defs - .*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n - 1 - - - oval:ssg-variable_last_pass_min_len_instance_value:var:1 - - - - /etc/login.defs - .*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n - 1 - - - oval:ssg-variable_last_pass_warn_age_instance_value:var:1 - - - .* - - - /etc/group - ^[^:]+:[^:]+:([0-9]+): - 1 - - - /etc/passwd - ^[^:]+:[^:]+:[0-9]+:([0-9]+): - 1 - - - /etc/pam.d/(system|password)-auth - ^[^#]*\bnullok\b.*$ - 1 - - - /etc/shadow - ^[^:]+::.*$ - 1 - - - /etc/group - ^\+.*$ - 1 - - - /etc/passwd - ^\+.*$ - 1 - - - /etc/shadow - ^\+.*$ - 1 - - - - /home - ^\.netrc$ - - - /etc/passwd - ^(?!root:)[^:]*:[^:]*:0 - 1 - - - /etc/passwd - ^root:.+:\d+:(\d+).+ - 1 - - - /etc/securetty - ^.*$ - 1 - - - /etc/securetty - ^$ - 1 - - - - /etc/login.defs - .*(?:^|\n)\s*(UID_MIN[\s]+[\d]+)\s*(?:$|\n) - 1 - - - - /etc/login.defs - .*(?:^|\n)\s*(SYS_UID_MIN[\s]+[\d]+)\s*(?:$|\n) - 1 - - - - /etc/login.defs - .*(?:^|\n)\s*(SYS_UID_MAX[\s]+[\d]+)\s*(?:$|\n) - 1 - - - /etc/passwd - ^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/bin\/false|\/usr\/bin\/false).*$ - 1 - - - /etc/securetty - ^ttyS[0-9]+$ - 1 - - - /etc/securetty - ^vc/[0-9]+$ - 1 - - - /etc/login.defs - ^[\s]*(?i)FAIL_DELAY(?-i)[\s]+([^#\s]*) - 1 - - - /etc/security/limits.conf - ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$ - 1 - - - /etc/security/limits.d - ^.*\.conf$ - ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$ - 1 - - - /etc/security/limits.d - ^.*\.conf$ - ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins - 1 - - - /tmp/tmp-inst - - - - /etc/security/namespace.conf - ^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$ - 1 - - - /var/tmp/tmp-inst - - - - /etc/security/namespace.conf - ^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$ - 1 - - - /etc/profile - ^[\s]*declare[\s]+-xr[\s]+TMOUT=([\w$]+).*$ - 1 - - - /etc/profile.d - ^.*\.sh$ - ^[\s]*declare[\s]+-xr[\s]+TMOUT=([\w$]+).*$ - 1 - - - nobody - oval:ssg-state_file_permissions_home_dirs_interactive_uids:ste:1 - - - - - - - - PATH - - - - - oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1 - oval:ssg-state_accounts_root_path_dirs_symlink:ste:1 - - - - PATH - - - /etc/bashrc - ^[\s]*umask[\s]+([^#\s]*) - 1 - - - oval:ssg-var_etc_bashrc_umask_as_number:var:1 - - - /etc/csh.cshrc - ^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*) - 1 - - - oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1 - - - /etc/login.defs - ^[\s]*UMASK[\s]+([^#\s]*) - 1 - - - oval:ssg-var_etc_login_defs_umask_as_number:var:1 - - - /etc/profile - ^[\s]*umask[\s]+([^#\s]*) - 1 - - - oval:ssg-var_etc_profile_umask_as_number:var:1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+task,never[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+task,never[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-e\s+2\s*$ - 1 - - - /etc/audit/audit.rules - ^\-e\s+2\s*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$ - 1 - - - /etc/audit/audit.rules - ^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$ - 1 - - - /etc/audit/audit.rules - ^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$ - 1 - - - /etc/audit/audit.rules - ^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - - - - oval:ssg-state_not_mode_0700:ste:1 - - - - /var/log/audit - - oval:ssg-state_not_mode_0700:ste:1 - - - - /var/log/audit - - oval:ssg-state_not_mode_0750:ste:1 - - - - - - oval:ssg-state_not_mode_0750:ste:1 - - - - /var/log/audit - - oval:ssg-state_owner_not_root_root_var_log_audit:ste:1 - - - - /var/log/audit - ^.*$ - oval:ssg-state_owner_not_root_root_var_log_audit:ste:1 - - - - /var/log/audit - - oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1 - - - - /var/log/audit - ^.*$ - oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1 - - - - oval:ssg-state_not_mode_0600:ste:1 - - - - /var/log/audit - ^.*$ - oval:ssg-state_not_mode_0600:ste:1 - - - - oval:ssg-state_not_mode_0640:ste:1 - - - - /var/log/audit - ^.*$ - oval:ssg-state_not_mode_0640:ste:1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - - / - [a-z]+ - oval:ssg-state_setuid_or_setgid_set:ste:1 - oval:ssg-state_dev_proc_sys_dirs:ste:1 - - - oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid>=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1 - - - /etc/audit/audit.rules - ^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid>=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audisp-remote.conf - ^[ ]*remote_server[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/audisp-remote.conf - ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/audisp-remote.conf - ^[ ]*enable_krb5[ ]+=[ ]+yes[ ]*$ - 1 - - - /etc/audit/audisp-remote.conf - ^[ ]*network_failure_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/plugins.d/syslog.conf - ^[ ]*active[ ]+=[ ]+yes[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[\s]*space_left[\s]+=[\s]+(\d+)[\s]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ \t]*(?i)overflow_action(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/audit/rules.d/10-base-config.rules - (?:.*\n)* - 1 - - - ^/usr/share/doc/audit(?:-\d.\d.\d)?/rules/10-base-config.rules - (?:.*\n)* - 1 - - - /etc/audit/rules.d/11-loginuid.rules - (?:.*\n)* - 1 - - - ^/usr/share/doc/audit(?:-\d.\d.\d)?/rules/11-loginuid.rules - (?:.*\n)* - 1 - - - /etc/audit/rules.d/30-ospp-v42.rules - (?:.*\n)* - 1 - - - ^/usr/share/doc/audit(?:-\d.\d.\d)?/rules/30-ospp-v42.rules - (?:.*\n)* - 1 - - - /etc/audit/rules.d/43-module-load.rules - (?:.*\n)* - 1 - - - ^/usr/share/doc/audit(?:-\d.\d.\d)?/rules/43-module-load.rules - (?:.*\n)* - 1 - - - .* - - - /boot/grub2/grub.cfg - ^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)"$ - 1 - - - /boot/grub2/user.cfg - ^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$ - 1 - - - /etc/zipl.conf - ^\s*image\s*=.*$ - 1 - - - /boot/bootmap - - - /etc/zipl.conf - - - ^/boot/loader/entries/.*\.conf$ - - - ^/boot/loader/entries/.*.conf - ^options (.*)$ - 1 - - - ^/etc/kernel/cmdline - ^(.*)$ - 1 - - - /etc/rsyslog.conf - ^\$ActionSendStreamDriverAuthMode x509/name$ - 1 - - - /etc/rsyslog.d - ^.*conf$ - ^\$ActionSendStreamDriverAuthMode x509/name$ - 1 - - - /etc/rsyslog.conf - ^\$ActionSendStreamDriverMode 1$ - 1 - - - /etc/rsyslog.d - ^.*conf$ - ^\$ActionSendStreamDriverMode 1$ - 1 - - - /etc/rsyslog.conf - ^\$DefaultNetstreamDriver gtls$ - 1 - - - /etc/rsyslog.d - ^.*conf$ - ^\$DefaultNetstreamDriver gtls$ - 1 - - - /etc/rsyslog.conf - ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ - 1 - - - oval:ssg-var_rfg_include_config_regex:var:1 - - - oval:ssg-var_rfg_syslog_config:var:1 - - - - oval:ssg-object_var_rfg_include_config_regex:obj:1 - oval:ssg-object_var_rfg_syslog_config:obj:1 - - - - - ^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$ - 1 - oval:ssg-state_groupownership_ignore_include_paths:ste:1 - - - - - - /etc/rsyslog.conf - ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ - 1 - - - oval:ssg-var_rfo_include_config_regex:var:1 - - - oval:ssg-var_rfo_syslog_config:var:1 - - - - oval:ssg-object_var_rfo_include_config_regex:obj:1 - oval:ssg-object_var_rfo_syslog_config:obj:1 - - - - - ^[^(#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$ - 1 - oval:ssg-state_owner_ignore_include_paths:ste:1 - - - - - - /etc/rsyslog.conf - ^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$ - 1 - - - oval:ssg-var_rfp_include_config_regex:var:1 - - - oval:ssg-var_rfp_syslog_config:var:1 - - - - oval:ssg-object_var_rfp_include_config_regex:obj:1 - oval:ssg-object_var_rfp_syslog_config:obj:1 - - - - - ^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$ - 1 - oval:ssg-state_permissions_ignore_include_paths:ste:1 - - - - - - /etc/logrotate.conf - ^\s*daily[\s#]*$ - 1 - - - /etc/logrotate.conf - ^\s*(weekly|monthly|yearly)[\s#]*$ - 1 - - - /etc/cron.daily/logrotate - ^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$ - 1 - - - /etc/rsyslog.conf - ^\*\.\*[\s]+(?:@|\:omrelp\:) - 1 - - - /etc/rsyslog.d - ^.+\.conf$ - ^\*\.\*[\s]+(?:@|\:omrelp\:) - 1 - - - ^/etc/polkit-1/localauthority/20-org.d/.*$ - ^\[.*\]\n\s*Identity=default\n\s*Action=org\.freedesktop\.NetworkManager\.\*\n\s*ResultAny=no\n\s*ResultInactive=no\n\s*(ResultActive=auth_admin)\n*\s*$ - 1 - - - /etc/modprobe.d - ^.*\.conf$ - ^\s*options\s+ipv6\s+.*disable=1.*$ - 1 - - - ^wl.*$ - - - - / - - oval:ssg-state_world_writable_and_not_sticky:ste:1 - - - /boot - ^System\.map.*$ - - - - / - ^.*$ - oval:ssg-state_file_permissions_unauthorized_world_write:ste:1 - oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1 - oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1 - oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1 - - - ^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec - - oval:ssg-state_owner_binaries_not_root:ste:1 - - - ^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec - ^.*$ - oval:ssg-state_owner_binaries_not_root:ste:1 - - - ^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec - ^.*$ - oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1 - oval:ssg-state_perms_binary_files_symlink:ste:1 - - - /etc/default/grub - ^[ \t]*GRUB_CMDLINE_LINUX=([^#]*).*$ - 1 - - - ^/\w.*$ - oval:ssg-state_local_nodev:ste:1 - - - /etc/systemd/coredump.conf - ^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/systemd/coredump.conf - ^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/security/limits.conf - ^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+) - 1 - - - /etc/security/limits.d - ^.*\.conf$ - ^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+) - 1 - - - /etc/security/limits.d - ^.*\.conf$ - ^[\s]*\*[\s]+(?:hard|-)[\s]+core - 1 - - - /etc/default/grub - ^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$ - 1 - - - /etc/grub2.cfg - ^.*(selinux|enforcing)=0.*$ - 1 - - - /etc/grub.d - ^.*$ - ^.*(selinux|enforcing)=0.*$ - 1 - - - - /proc - ^.*$ - oval:ssg-state_selinux_confinement_of_daemons:ste:1 - - - /etc/selinux/config - ^SELINUXTYPE=([\w]*)[\s]*$ - 1 - - - /etc/selinux/config - ^SELINUX=(.*)$ - 1 - - - /proc/cpuinfo - ^flags\s+:\s+(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /etc/gdm/custom.conf - ^\s*\[xdmcp\].*(?:\n\s*[^[\s].*)*\n^\s*Enable[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - ^/etc/gdm/custom.conf - - - /etc/sysconfig/prelink - ^[\s]*PRELINKING=no[\s]* - 1 - - - /etc/named.conf - ^\s*include\s+"/etc/crypto-policies/back-ends/bind.config"\s*;\s*$ - 1 - - - /etc/crypto-policies/state/current - - - /etc/crypto-policies/config - - - oval:ssg-variable_crypto_policies_config_file_timestamp:var:1 - - - /etc/crypto-policies/config - ^(?!#)(\S+)$ - 1 - - - /etc/crypto-policies/state/current - ^(?!#)(\S+)$ - 1 - - - /etc/crypto-policies/back-ends/nss.config - - - oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1 - - - /etc/krb5.conf.d/crypto-policies - - - /etc/crypto-policies/back-ends/krb5.config - - - /etc/ipsec.conf - ^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$ - 1 - - - /etc/pki/tls/openssl.cnf - ^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\s*$ - 1 - - - /etc/sysconfig/sshd - ^\s*(?i)CRYPTO_POLICY\s*=.*$ - 1 - - - /etc/crypto-policies/back-ends/opensslcnf.config - ^(?:.*\n)*\s*Ciphersuites\s*=\s*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/ssh_config.d/02-ospp.conf - ^[ \t]*Match[\s]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/ssh_config.d/02-ospp.conf - ^Match final all(?:.* -)*?\s*RekeyLimit[\s]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/ssh_config.d/02-ospp.conf - ^Match final all(?:.* -)*?\s*GSSAPIAuthentication[\s]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/ssh_config.d/02-ospp.conf - ^Match final all(?:.* -)*?\s*Ciphers[\s]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/ssh_config.d/02-ospp.conf - ^Match final all(?:.* -)*?\s*PubkeyAcceptedKeyTypes[\s]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/ssh_config.d/02-ospp.conf - ^Match final all(?:.* -)*?\s*MACs[\s]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/ssh_config.d/02-ospp.conf - ^Match final all(?:.* -)*?\s*KexAlgorithms[\s]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/crypto-policies/back-ends/opensshserver.config - ^(?:.*\n)*\s*CRYPTO_POLICY=(.+?)[ \t]*(?:$|#) - 1 - - - McAfeeVSEForLinux - - - MFErt - - - MFEcma - - - /opt/McAfee/accm/bin - accm - - - /opt/McAfee/auditengine/bin - auditmanager - - - /etc/dracut.conf.d/40-fips.conf - ^\s*add_dracutmodules\+="\s*(\w*)\s*"\s*(?:#.*)?$ - 1 - - - oval:ssg-var_system_crypto_policy:var:1 - - - /etc/system-fips - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /proc/cpuinfo - ^[\s]*flags[\s]*:[\s]*.*aes.*$ - 1 - - - dracut-fips-aesni - - - dracut-fips - - - /proc/sys/crypto/fips_enabled - ^1$ - 1 - - - /etc/aide.conf - ^@@define[\s]DBDIR[\s]+(/.*)$ - 1 - - - /etc/aide.conf - ^database_out=file:@@{DBDIR}/([a-z.]+)$ - 1 - - - /etc/aide.conf - ^database=file:@@{DBDIR}/([a-z.]+)$ - 1 - - - - - - - - - - .* - .* - .* - .* - .* - .* - oval:ssg-state_files_fail_user_ownership:ste:1 - - - - .* - .* - .* - .* - .* - .* - oval:ssg-state_files_fail_group_ownership:ste:1 - - - - .* - .* - .* - .* - .* - .* - oval:ssg-state_files_fail_mode:ste:1 - - - /etc/sudoers - ^(?!#).*[\s]+\!authenticate.*$ - 1 - - - /etc/sudoers.d - ^.*$ - ^(?!#).*[\s]+\!authenticate.*$ - 1 - - - /etc/sudoers - ^(?!#).*[\s]+NOPASSWD[\s]*\:.*$ - 1 - - - /etc/sudoers.d - ^.*$ - ^(?!#).*[\s]+NOPASSWD[\s]*\:.*$ - 1 - - - /etc/sudoers - ^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$ - 1 - - - /etc/sudoers.d - ^.*$ - ^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$ - 1 - - - ^/etc/sudoers(\.d/.*)?$ - ^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$)) - 1 - - - ^/etc/sudoers(\.d/.*)?$ - ^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).* - 1 - - - ^/etc/sudoers(\.d/.*)?$ - ^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\) - 1 - - - ^/etc/sudoers(\.d/.*)?$ - ^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s] - 1 - - - gpg-pubkey - - - - /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-3-access-success.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/10-base-config.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-1-create-success.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/11-loginuid.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/43-module-load.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules - ^.*$ - 1 - - - - /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules - ^.*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/init[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/init[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/poweroff[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/poweroff[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/reboot[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/reboot[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/shutdown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/shutdown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setfiles[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setfiles[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/var\/run\/faillock[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/var\/run\/faillock[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/var\/log\/tallylog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/var\/log\/tallylog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/pam_timestamp_check[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/pam_timestamp_check[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postdrop[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postdrop[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postqueue[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postqueue[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - /etc/audit/audit.rules - - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$ - 1 - - - /etc/audit/auditd.conf - ^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/audit/auditd.conf - ^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/audit/auditd.conf - ^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/audit/auditd.conf - ^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/audit/auditd.conf - ^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) - 1 - - - /etc/audit/auditd.conf - ^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]* - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - - - ^/boot/loader/entries/ostree-1-.*.conf - ^options (.*)$ - 1 - - - ^/boot/loader/entries/ostree-2-.*.conf - ^options (.*)$ - 1 - - - ^/proc/cmdline - ^BOOT_IMAGE(.*)$ - 1 - - - - /bin - - oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_0:ste:1 - - - - /sbin - - oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_1:ste:1 - - - - /usr/bin - - oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_2:ste:1 - - - - /usr/sbin - - oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_3:ste:1 - - - - /usr/local/bin - - oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_4:ste:1 - - - - /usr/local/sbin - - oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_5:ste:1 - - - - /lib - - oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_0:ste:1 - - - - /lib64 - - oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_1:ste:1 - - - - /usr/lib - - oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_2:ste:1 - - - - /usr/lib64 - - oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_3:ste:1 - - - - /bin - - oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1 - - - - /sbin - - oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1 - - - - /usr/bin - - oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1 - - - - /usr/sbin - - oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1 - - - - /usr/local/bin - - oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1 - - - - /usr/local/sbin - - oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1 - - - - /lib - - oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_7755or_stricter_:ste:1 - - - - /lib64 - - oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_7755or_stricter_:ste:1 - - - - /usr/lib - - oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_7755or_stricter_:ste:1 - - - - /usr/lib64 - - oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1 - oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_7755or_stricter_:ste:1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/group- - oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1 - oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1 - - - /etc/gshadow- - oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1 - oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1 - - - /etc/passwd- - oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1 - oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1 - - - /etc/shadow- - oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1 - oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1 - - - /etc/group - oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1 - oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1 - - - /etc/gshadow - oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1 - oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1 - - - /etc/issue - oval:ssg-symlink_file_groupowner_etc_issue_uid_0:ste:1 - oval:ssg-state_file_groupowner_etc_issue_gid_0_0:ste:1 - - - /etc/passwd - oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1 - oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1 - - - /etc/shadow - oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1 - oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1 - - - /etc/ssh/sshd_config - oval:ssg-symlink_file_groupowner_sshd_config_uid_0:ste:1 - oval:ssg-state_file_groupowner_sshd_config_gid_0_0:ste:1 - - - /var/log - - oval:ssg-symlink_file_groupowner_var_log_uid_0:ste:1 - oval:ssg-state_file_groupowner_var_log_gid_0_0:ste:1 - - - /var/log/messages - oval:ssg-symlink_file_groupowner_var_log_messages_uid_0:ste:1 - oval:ssg-state_file_groupowner_var_log_messages_gid_0_0:ste:1 - - - /var/log/syslog - oval:ssg-symlink_file_groupowner_var_log_syslog_uid_4:ste:1 - oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1 - - - /etc/audit - ^audit(\.rules|d\.conf)$ - oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1 - oval:ssg-state_file_groupownership_audit_configuration_gid_0_0:ste:1 - - - /etc/audit/rules.d - ^.*\.rules$ - oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1 - oval:ssg-state_file_groupownership_audit_configuration_gid_0_1:ste:1 - - - /etc/group- - oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1 - oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1 - - - /etc/gshadow- - oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1 - oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1 - - - /etc/passwd- - oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1 - oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1 - - - /etc/shadow- - oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1 - oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1 - - - /etc/group - oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1 - oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1 - - - /etc/gshadow - oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1 - oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1 - - - /etc/issue - oval:ssg-symlink_file_owner_etc_issue_uid_0:ste:1 - oval:ssg-state_file_owner_etc_issue_uid_0_0:ste:1 - - - /etc/passwd - oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1 - oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1 - - - /etc/shadow - oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1 - oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1 - - - /etc/ssh/sshd_config - oval:ssg-symlink_file_owner_sshd_config_uid_0:ste:1 - oval:ssg-state_file_owner_sshd_config_uid_0_0:ste:1 - - - /var/log - - oval:ssg-symlink_file_owner_var_log_uid_0:ste:1 - oval:ssg-state_file_owner_var_log_uid_0_0:ste:1 - - - /var/log/messages - oval:ssg-symlink_file_owner_var_log_messages_uid_0:ste:1 - oval:ssg-state_file_owner_var_log_messages_uid_0_0:ste:1 - - - /var/log/syslog - oval:ssg-symlink_file_owner_var_log_syslog_uid_104:ste:1 - oval:ssg-state_file_owner_var_log_syslog_uid_104_0:ste:1 - - - /etc/audit - ^audit(\.rules|d\.conf)$ - oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1 - oval:ssg-state_file_ownership_audit_configuration_uid_0_0:ste:1 - - - /etc/audit/rules.d - ^.*\.rules$ - oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1 - oval:ssg-state_file_ownership_audit_configuration_uid_0_1:ste:1 - - - - /lib - ^.*$ - oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownership_library_dirs_uid_0_0:ste:1 - - - - /lib64 - ^.*$ - oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownership_library_dirs_uid_0_1:ste:1 - - - - /usr/lib - ^.*$ - oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownership_library_dirs_uid_0_2:ste:1 - - - - /usr/lib64 - ^.*$ - oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1 - oval:ssg-state_file_ownership_library_dirs_uid_0_3:ste:1 - - - /etc/group- - oval:ssg-exclude_symlinks__backup_etc_group:ste:1 - oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1 - - - /etc/gshadow- - oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1 - oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1 - - - /etc/passwd- - oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1 - oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1 - - - /etc/shadow- - oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1 - oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1 - - - /etc/group - oval:ssg-exclude_symlinks__etc_group:ste:1 - oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1 - - - /etc/gshadow - oval:ssg-exclude_symlinks__etc_gshadow:ste:1 - oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1 - - - /etc/issue - oval:ssg-exclude_symlinks__etc_issue:ste:1 - oval:ssg-state_file_permissions_etc_issue_0_mode_0644or_stricter_:ste:1 - - - /etc/passwd - oval:ssg-exclude_symlinks__etc_passwd:ste:1 - oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1 - - - /etc/shadow - oval:ssg-exclude_symlinks__etc_shadow:ste:1 - oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1 - - - - /lib - ^.*$ - oval:ssg-exclude_symlinks__library_dirs:ste:1 - oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1 - - - - /lib64 - ^.*$ - oval:ssg-exclude_symlinks__library_dirs:ste:1 - oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1 - - - - /usr/lib - ^.*$ - oval:ssg-exclude_symlinks__library_dirs:ste:1 - oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1 - - - - /usr/lib64 - ^.*$ - oval:ssg-exclude_symlinks__library_dirs:ste:1 - oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1 - - - /etc/ssh/sshd_config - oval:ssg-exclude_symlinks__sshd_config:ste:1 - oval:ssg-state_file_permissions_sshd_config_0_mode_0600or_stricter_:ste:1 - - - /etc/ssh - ^.*.pub$ - oval:ssg-exclude_symlinks__sshd_pub_key:ste:1 - oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1 - - - /var/log - - oval:ssg-exclude_symlinks__var_log:ste:1 - oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1 - - - /var/log/messages - oval:ssg-exclude_symlinks__var_log_messages:ste:1 - oval:ssg-state_file_permissions_var_log_messages_0_mode_0640or_stricter_:ste:1 - - - /var/log/syslog - oval:ssg-exclude_symlinks__var_log_syslog:ste:1 - oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmap\b.*).*"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmap\b).*"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmep\b.*).*"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmep\b).*"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX="(?!.*\bsystemd.debug-shell\b.*).*"$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bsystemd.debug-shell\b).*"$ - 1 - - - ^/boot/config-.*$ - ^CONFIG_ACPI_CUSTOM_METHOD="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_acpi_custom_method_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_BINFMT_MISC="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_binfmt_misc_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_BUG="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_bug_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_COMPAT_BRK="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_compat_brk_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_COMPAT_VDSO="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_compat_vdso_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_DEBUG_CREDENTIALS="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_debug_credentials_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_DEBUG_FS="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_debug_fs_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_DEBUG_LIST="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_debug_list_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_DEBUG_NOTIFIERS="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_debug_notifiers_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_DEBUG_SG="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_debug_sg_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_DEFAULT_MMAP_MIN_ADDR="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_default_mmap_min_addr_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_DEVKMEM="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_devkmem_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_HIBERNATION="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_hibernation_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_IA32_EMULATION="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_ia32_emulation_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_IPV6="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_ipv6_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_KEXEC="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_kexec_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_LEGACY_PTYS="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_legacy_ptys_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_MODULE_SIG="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_module_sig_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_MODULE_SIG_ALL="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_module_sig_all_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_MODULE_SIG_FORCE="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_module_sig_force_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_MODULE_SIG_HASH="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_module_sig_hash_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_MODULE_SIG_KEY="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_module_sig_key_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_MODULE_SIG_SHA512="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_module_sig_sha512_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_PAGE_POISONING_NO_SANITY="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_page_poisoning_no_sanity_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_PAGE_POISONING_ZERO="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_page_poisoning_zero_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_PAGE_TABLE_ISOLATION="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_page_table_isolation_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_PANIC_ON_OOPS="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_panic_on_oops_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_PANIC_TIMEOUT="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_panic_timeout_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_PROC_KCORE="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_proc_kcore_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_RANDOMIZE_BASE="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_randomize_base_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_RANDOMIZE_MEMORY="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_randomize_memory_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_RETPOLINE="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_retpoline_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SECCOMP="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_seccomp_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SECCOMP_FILTER="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_seccomp_filter_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SECURITY="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_security_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SECURITY_DMESG_RESTRICT="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_security_dmesg_restrict_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SECURITY_WRITABLE_HOOKS="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_security_writable_hooks_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SECURITY_YAMA="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_security_yama_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SLUB_DEBUG="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_slub_debug_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_SYN_COOKIES="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_syn_cookies_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_UNMAP_KERNEL_AT_EL0="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_unmap_kernel_at_el0_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - ^/boot/config-.*$ - ^CONFIG_X86_VSYSCALL_EMULATION="?(.*?)"?$ - 1 - - - oval:ssg-local_var_config_x86_vsyscall_emulation_count_kernels_installed:var:1 - - - /boot - ^config-.*$ - - - - ^.*\.conf$ - ^\s*install\s+atm\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+atm$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+atm\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+bluetooth$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+can\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+can$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+can\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+cfg80211$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+cramfs$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+firewire-core$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+freevxfs$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+hfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+hfs$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+hfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+hfsplus$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+iwlmvm$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+iwlwifi$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+jffs2\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+jffs2$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+jffs2\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+mac80211\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+mac80211$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+mac80211\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+rds\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+rds$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+rds\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+sctp$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+squashfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+squashfs$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+squashfs\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+tipc$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+udf\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+udf$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+udf\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+usb-storage$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+uvcvideo\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+uvcvideo$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+uvcvideo\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^\s*install\s+vfat\s+(/bin/false|/bin/true)$ - 1 - - - - ^.*\.conf$ - ^blacklist\s+vfat$ - 1 - - - /etc/modprobe.conf - ^\s*install\s+vfat\s+(/bin/false|/bin/true)$ - 1 - - - /boot - - - /boot - - - /dev/shm - - - /dev/shm - - - /dev/shm - - - /home - - - /home - - - /etc/fstab - - 1 - - - /etc/fstab - - 1 - - - /etc/fstab - - 1 - - - /etc/fstab - - 1 - - - /etc/fstab - - 1 - - - /etc/fstab - - 1 - - - /tmp - - - /tmp - - - /tmp - - - /var/log/audit - - - /var/log/audit - - - /var/log/audit - - - /var/log - - - /var/log - - - /var/log - - - /var - - - /var - - - /var/tmp - - - /var/tmp - - - /var/tmp - - - GConf2 - - - MFEhiplsm - - - aide - - - audispd-plugins - - - audit-audispd-plugins - - - audit - - - avahi - - - bind - - - chrony - - - cron - - - dconf - - - esc - - - fapolicyd - - - firewalld - - - gdm - - - gnutls-utils - - - inetutils-telnetd - - - iptables - - - libreswan - - - libselinux - - - net-snmp - - - nis - - - nss-tools - - - ntp - - - ntpdate - - - openldap-clients - - - openssh-server - - - openssh-server - - - pam_ldap - - - postfix - - - prelink - - - rsyslog - - - samba-common - - - samba-common - - - sendmail - - - setroubleshoot-plugins - - - setroubleshoot-server - - - sudo - - - syslog-ng - - - telnetd-ssl - - - telnetd - - - tmux - - - usbguard - - - /home - - - /srv - - - /tmp - - - /var - - - /var/tmp - - - multi-user.target - - - multi-user.target - - - ^auditd\.(socket|service)$ - ActiveState - - - audit - - - ^autofs\.(service|socket)$ - ActiveState - - - ^autofs\.(service|socket)$ - LoadState - - - autofs - - - ^bluetooth\.(service|socket)$ - ActiveState - - - ^bluetooth\.(service|socket)$ - LoadState - - - bluez - - - multi-user.target - - - multi-user.target - - - ^chronyd\.(socket|service)$ - ActiveState - - - chrony - - - multi-user.target - - - multi-user.target - - - ^cron\.(socket|service)$ - ActiveState - - - cron - - - ^debug-shell\.(service|socket)$ - ActiveState - - - ^debug-shell\.(service|socket)$ - LoadState - - - systemd - - - multi-user.target - - - multi-user.target - - - ^fapolicyd\.(socket|service)$ - ActiveState - - - fapolicyd - - - multi-user.target - - - multi-user.target - - - ^firewalld\.(socket|service)$ - ActiveState - - - firewalld - - - multi-user.target - - - multi-user.target - - - ^ip6tables\.(socket|service)$ - ActiveState - - - iptables-ipv6 - - - multi-user.target - - - multi-user.target - - - ^iptables\.(socket|service)$ - ActiveState - - - iptables - - - ^netfs\.(service|socket)$ - ActiveState - - - ^netfs\.(service|socket)$ - LoadState - - - netfs - - - multi-user.target - - - multi-user.target - - - ^ntp\.(socket|service)$ - ActiveState - - - ntp - - - multi-user.target - - - multi-user.target - - - ^ntpd\.(socket|service)$ - ActiveState - - - ntp - - - multi-user.target - - - multi-user.target - - - ^rngd\.(socket|service)$ - ActiveState - - - rng-tools - - - multi-user.target - - - multi-user.target - - - ^rsyslog\.(socket|service)$ - ActiveState - - - rsyslog - - - ^sshd\.(service|socket)$ - ActiveState - - - ^sshd\.(service|socket)$ - LoadState - - - openssh-server - - - ^syslog\.(service|socket)$ - ActiveState - - - ^syslog\.(service|socket)$ - LoadState - - - rsyslog - - - multi-user.target - - - multi-user.target - - - ^syslog-ng\.(socket|service)$ - ActiveState - - - syslog-ng - - - ^systemd-coredump\.(service|socket)$ - ActiveState - - - ^systemd-coredump\.(service|socket)$ - LoadState - - - systemd - - - multi-user.target - - - multi-user.target - - - ^systemd-journald\.(socket|service)$ - ActiveState - - - systemd - - - multi-user.target - - - multi-user.target - - - ^ufw\.(socket|service)$ - ActiveState - - - ufw - - - multi-user.target - - - multi-user.target - - - ^usbguard\.(socket|service)$ - ActiveState - - - usbguard - - - /etc/ssh/sshd_config - ^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[\s]*Include /etc/ssh/sshd_config\.d/\*\.conf[\s]*$ - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - /etc/ssh/sshd_config - ^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#) - 1 - - - ^/etc/sudoers(|\.d/.*)$ - ^[\s]*Defaults[\s]*\bnoexec.*$ - 1 - - - ^/etc/sudoers(|\.d/.*)$ - ^[\s]*Defaults[\s]*\brequiretty.*$ - 1 - - - ^/etc/sudoers(|\.d/.*)$ - ^[\s]*Defaults[\s]*\buse_pty.*$ - 1 - - - ^/etc/sudoers(|\.d/.*)$ - ^[\s]*Defaults[\s]*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b).*$ - 1 - - - fs.protected_hardlinks - - - oval:ssg-local_var_sysctl_fs_protected_hardlinks_counter:var:1 - - - - oval:ssg-object_sysctl_fs_protected_hardlinks_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_fs_protected_hardlinks_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_fs_protected_hardlinks:obj:1 - oval:ssg-var_obj_blank_sysctl_fs_protected_hardlinks:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_fs_protected_hardlinks:var:1 - - - oval:ssg-local_var_symlinks_sysctl_fs_protected_hardlinks:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_fs_protected_hardlinks:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_hardlinks:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_fs_protected_hardlinks:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_fs_protected_hardlinks:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_hardlinks:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_fs_protected_hardlinks:obj:1 - - - - /etc/sysctl.conf - ^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$ - 1 - - - fs.protected_symlinks - - - oval:ssg-local_var_sysctl_fs_protected_symlinks_counter:var:1 - - - - oval:ssg-object_sysctl_fs_protected_symlinks_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_fs_protected_symlinks_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_fs_protected_symlinks:obj:1 - oval:ssg-var_obj_blank_sysctl_fs_protected_symlinks:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_fs_protected_symlinks:var:1 - - - oval:ssg-local_var_symlinks_sysctl_fs_protected_symlinks:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_fs_protected_symlinks:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_symlinks:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_fs_protected_symlinks:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_fs_protected_symlinks:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_symlinks:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_fs_protected_symlinks:obj:1 - - - - /etc/sysctl.conf - ^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$ - 1 - - - fs.suid_dumpable - - - oval:ssg-local_var_sysctl_fs_suid_dumpable_counter:var:1 - - - - oval:ssg-object_sysctl_fs_suid_dumpable_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_fs_suid_dumpable_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_fs_suid_dumpable:obj:1 - oval:ssg-var_obj_blank_sysctl_fs_suid_dumpable:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_fs_suid_dumpable:var:1 - - - oval:ssg-local_var_symlinks_sysctl_fs_suid_dumpable:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_fs_suid_dumpable:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_fs_suid_dumpable:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_fs_suid_dumpable:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_fs_suid_dumpable:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_fs_suid_dumpable:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_fs_suid_dumpable:obj:1 - - - - /etc/sysctl.conf - ^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.core_pattern - - - oval:ssg-local_var_sysctl_kernel_core_pattern_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_core_pattern_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_core_pattern_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_core_pattern:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_core_pattern:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_core_pattern:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_core_pattern:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_core_pattern:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_pattern:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_core_pattern:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_core_pattern:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_pattern:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_core_pattern:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.core_pattern - - - oval:ssg-local_var_sysctl_kernel_core_pattern_empty_string_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_core_pattern_empty_string_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_core_pattern_empty_string:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_core_pattern_empty_string:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_core_pattern_empty_string:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_core_pattern_empty_string:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_core_pattern_empty_string:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_pattern_empty_string:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_core_pattern_empty_string:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_core_pattern_empty_string:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.core_uses_pid - - - oval:ssg-local_var_sysctl_kernel_core_uses_pid_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_core_uses_pid_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_core_uses_pid_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_core_uses_pid:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_core_uses_pid:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_core_uses_pid:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_core_uses_pid:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_core_uses_pid:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_uses_pid:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_core_uses_pid:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_core_uses_pid:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_uses_pid:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_core_uses_pid:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.dmesg_restrict - - - oval:ssg-local_var_sysctl_kernel_dmesg_restrict_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_dmesg_restrict_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_dmesg_restrict_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_dmesg_restrict:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_dmesg_restrict:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_dmesg_restrict:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_dmesg_restrict:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_dmesg_restrict:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_dmesg_restrict:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_dmesg_restrict:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_dmesg_restrict:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_dmesg_restrict:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_dmesg_restrict:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.kexec_load_disabled - - - oval:ssg-local_var_sysctl_kernel_kexec_load_disabled_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_kexec_load_disabled_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_kexec_load_disabled_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_kexec_load_disabled:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_kexec_load_disabled:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_kexec_load_disabled:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_kexec_load_disabled:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_kexec_load_disabled:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_kexec_load_disabled:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_kexec_load_disabled:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_kexec_load_disabled:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_kexec_load_disabled:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_kexec_load_disabled:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.kptr_restrict - - - oval:ssg-local_var_sysctl_kernel_kptr_restrict_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_kptr_restrict_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_kptr_restrict_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_kptr_restrict:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_kptr_restrict:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_kptr_restrict:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_kptr_restrict:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_kptr_restrict:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_kptr_restrict:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_kptr_restrict:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_kptr_restrict:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_kptr_restrict:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_kptr_restrict:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.panic_on_oops - - - oval:ssg-local_var_sysctl_kernel_panic_on_oops_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_panic_on_oops_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_panic_on_oops_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_panic_on_oops:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_panic_on_oops:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_panic_on_oops:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_panic_on_oops:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_panic_on_oops:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_panic_on_oops:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_panic_on_oops:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_panic_on_oops:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_panic_on_oops:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_panic_on_oops:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.perf_event_paranoid - - - oval:ssg-local_var_sysctl_kernel_perf_event_paranoid_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_perf_event_paranoid_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_perf_event_paranoid_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_perf_event_paranoid:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_perf_event_paranoid:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_perf_event_paranoid:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_perf_event_paranoid:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_perf_event_paranoid:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_perf_event_paranoid:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_perf_event_paranoid:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_perf_event_paranoid:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_perf_event_paranoid:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_perf_event_paranoid:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.randomize_va_space - - - oval:ssg-local_var_sysctl_kernel_randomize_va_space_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_randomize_va_space_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_randomize_va_space_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_randomize_va_space:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_randomize_va_space:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_randomize_va_space:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_randomize_va_space:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_randomize_va_space:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_randomize_va_space:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_randomize_va_space:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_randomize_va_space:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_randomize_va_space:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_randomize_va_space:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.unprivileged_bpf_disabled - - - oval:ssg-local_var_sysctl_kernel_unprivileged_bpf_disabled_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_unprivileged_bpf_disabled_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_unprivileged_bpf_disabled:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_unprivileged_bpf_disabled:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_unprivileged_bpf_disabled:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_unprivileged_bpf_disabled:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_unprivileged_bpf_disabled:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_unprivileged_bpf_disabled:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$ - 1 - - - kernel.yama.ptrace_scope - - - oval:ssg-local_var_sysctl_kernel_yama_ptrace_scope_counter:var:1 - - - - oval:ssg-object_sysctl_kernel_yama_ptrace_scope_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_kernel_yama_ptrace_scope_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_kernel_yama_ptrace_scope:obj:1 - oval:ssg-var_obj_blank_sysctl_kernel_yama_ptrace_scope:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_kernel_yama_ptrace_scope:var:1 - - - oval:ssg-local_var_symlinks_sysctl_kernel_yama_ptrace_scope:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_yama_ptrace_scope:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_kernel_yama_ptrace_scope:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1 - - - - /etc/sysctl.conf - ^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.core.bpf_jit_harden - - - oval:ssg-local_var_sysctl_net_core_bpf_jit_harden_counter:var:1 - - - - oval:ssg-object_sysctl_net_core_bpf_jit_harden_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_core_bpf_jit_harden_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_core_bpf_jit_harden:obj:1 - oval:ssg-var_obj_blank_sysctl_net_core_bpf_jit_harden:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_core_bpf_jit_harden:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_core_bpf_jit_harden:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_core_bpf_jit_harden:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_core_bpf_jit_harden:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_core_bpf_jit_harden:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_core_bpf_jit_harden:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_core_bpf_jit_harden:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_core_bpf_jit_harden:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.accept_local - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_accept_local_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_accept_local_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_accept_local_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_accept_local:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_accept_local:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_accept_local:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_accept_local:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_accept_local:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_local:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.accept_redirects - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_accept_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_accept_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_accept_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_accept_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_accept_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.accept_source_route - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_accept_source_route_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_accept_source_route_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_accept_source_route:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_accept_source_route:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_accept_source_route:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.arp_filter - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_arp_filter_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_arp_filter_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_arp_filter_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_arp_filter:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_arp_filter:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_arp_filter:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_arp_filter:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_arp_filter:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_arp_filter:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.arp_ignore - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_arp_ignore_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_arp_ignore_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_arp_ignore_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_arp_ignore:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_arp_ignore:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_arp_ignore:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_arp_ignore:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_arp_ignore:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_arp_ignore:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.log_martians - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_log_martians_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_log_martians_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_log_martians:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_log_martians:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_log_martians:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_log_martians:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_log_martians:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_log_martians:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.route_localnet - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_route_localnet_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_route_localnet_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_route_localnet_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_route_localnet:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_route_localnet:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_route_localnet:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_route_localnet:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_route_localnet:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_route_localnet:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.rp_filter - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_rp_filter_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_rp_filter_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_rp_filter:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_rp_filter:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_rp_filter:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_rp_filter:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_rp_filter:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_rp_filter:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.secure_redirects - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_secure_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_secure_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_secure_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_secure_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_secure_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.send_redirects - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_send_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_send_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_send_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_send_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_send_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_send_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_send_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_send_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.all.shared_media - - - oval:ssg-local_var_sysctl_net_ipv4_conf_all_shared_media_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_all_shared_media_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_all_shared_media_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_all_shared_media:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_all_shared_media:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_all_shared_media:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_all_shared_media:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_all_shared_media:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_shared_media:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.default.accept_redirects - - - oval:ssg-local_var_sysctl_net_ipv4_conf_default_accept_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_default_accept_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_default_accept_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_default_accept_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_default_accept_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.default.accept_source_route - - - oval:ssg-local_var_sysctl_net_ipv4_conf_default_accept_source_route_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_default_accept_source_route_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_default_accept_source_route:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_default_accept_source_route:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_default_accept_source_route:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.default.log_martians - - - oval:ssg-local_var_sysctl_net_ipv4_conf_default_log_martians_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_default_log_martians_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_default_log_martians:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_default_log_martians:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_default_log_martians:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_default_log_martians:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_default_log_martians:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_log_martians:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.default.rp_filter - - - oval:ssg-local_var_sysctl_net_ipv4_conf_default_rp_filter_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_default_rp_filter_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_default_rp_filter:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_default_rp_filter:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_default_rp_filter:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_default_rp_filter:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_default_rp_filter:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_rp_filter:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.default.secure_redirects - - - oval:ssg-local_var_sysctl_net_ipv4_conf_default_secure_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_default_secure_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_default_secure_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_default_secure_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_default_secure_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.default.send_redirects - - - oval:ssg-local_var_sysctl_net_ipv4_conf_default_send_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_default_send_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_default_send_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_default_send_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_default_send_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_default_send_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_default_send_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_send_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.conf.default.shared_media - - - oval:ssg-local_var_sysctl_net_ipv4_conf_default_shared_media_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_conf_default_shared_media_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_conf_default_shared_media_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_conf_default_shared_media:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_conf_default_shared_media:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_conf_default_shared_media:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_conf_default_shared_media:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_conf_default_shared_media:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_shared_media:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.icmp_echo_ignore_broadcasts - - - oval:ssg-local_var_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.icmp_ignore_bogus_error_responses - - - oval:ssg-local_var_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.ip_forward - - - oval:ssg-local_var_sysctl_net_ipv4_ip_forward_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_ip_forward_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_ip_forward_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_ip_forward:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_ip_forward:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_ip_forward:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_ip_forward:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_ip_forward:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_ip_forward:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_ip_forward:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_ip_forward:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_ip_forward:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_ip_forward:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.tcp_invalid_ratelimit - - - oval:ssg-local_var_sysctl_net_ipv4_tcp_invalid_ratelimit_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_tcp_invalid_ratelimit_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_tcp_invalid_ratelimit_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_tcp_invalid_ratelimit:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_tcp_invalid_ratelimit:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_tcp_invalid_ratelimit:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_tcp_invalid_ratelimit:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_tcp_invalid_ratelimit:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_tcp_invalid_ratelimit:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_tcp_invalid_ratelimit:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_tcp_invalid_ratelimit:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_tcp_invalid_ratelimit:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_tcp_invalid_ratelimit:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.tcp_invalid_ratelimit[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.tcp_invalid_ratelimit[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.tcp_invalid_ratelimit[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv4.tcp_syncookies - - - oval:ssg-local_var_sysctl_net_ipv4_tcp_syncookies_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv4_tcp_syncookies_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv4_tcp_syncookies_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv4_tcp_syncookies:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv4_tcp_syncookies:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv4_tcp_syncookies:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv4_tcp_syncookies:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv4_tcp_syncookies:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv4_tcp_syncookies:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.all.accept_ra - - - oval:ssg-local_var_sysctl_net_ipv6_conf_all_accept_ra_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_all_accept_ra:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_all_accept_ra:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_all_accept_ra:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_all_accept_ra:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_all_accept_ra:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.all.accept_redirects - - - oval:ssg-local_var_sysctl_net_ipv6_conf_all_accept_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_all_accept_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_all_accept_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_all_accept_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_all_accept_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_all_accept_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.all.accept_source_route - - - oval:ssg-local_var_sysctl_net_ipv6_conf_all_accept_source_route_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_all_accept_source_route_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_all_accept_source_route_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_all_accept_source_route:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_all_accept_source_route:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_all_accept_source_route:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.all.disable_ipv6 - - - oval:ssg-local_var_sysctl_net_ipv6_conf_all_disable_ipv6_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_all_disable_ipv6:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_all_disable_ipv6:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_all_disable_ipv6:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.default.accept_ra - - - oval:ssg-local_var_sysctl_net_ipv6_conf_default_accept_ra_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_default_accept_ra:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_default_accept_ra:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_default_accept_ra:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_default_accept_ra:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_default_accept_ra:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.default.accept_redirects - - - oval:ssg-local_var_sysctl_net_ipv6_conf_default_accept_redirects_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_default_accept_redirects_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_default_accept_redirects:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_default_accept_redirects:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_default_accept_redirects:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.default.accept_source_route - - - oval:ssg-local_var_sysctl_net_ipv6_conf_default_accept_source_route_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_default_accept_source_route_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_default_accept_source_route_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_default_accept_source_route:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_default_accept_source_route:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_default_accept_source_route:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ - 1 - - - net.ipv6.conf.default.disable_ipv6 - - - oval:ssg-local_var_sysctl_net_ipv6_conf_default_disable_ipv6_counter:var:1 - - - - oval:ssg-object_sysctl_net_ipv6_conf_default_disable_ipv6_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_net_ipv6_conf_default_disable_ipv6_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1 - oval:ssg-var_obj_blank_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_net_ipv6_conf_default_disable_ipv6:var:1 - - - oval:ssg-local_var_symlinks_sysctl_net_ipv6_conf_default_disable_ipv6:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_net_ipv6_conf_default_disable_ipv6:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1 - - - - /etc/sysctl.conf - ^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ - 1 - - - user.max_user_namespaces - - - oval:ssg-local_var_sysctl_user_max_user_namespaces_counter:var:1 - - - - oval:ssg-object_sysctl_user_max_user_namespaces_static_set_sysctls_unfiltered:obj:1 - oval:ssg-state_sysctl_user_max_user_namespaces_filepath_is_symlink:ste:1 - - - - - oval:ssg-var_obj_symlink_sysctl_user_max_user_namespaces:obj:1 - oval:ssg-var_obj_blank_sysctl_user_max_user_namespaces:obj:1 - - - - oval:ssg-local_var_blank_path_sysctl_user_max_user_namespaces:var:1 - - - oval:ssg-local_var_symlinks_sysctl_user_max_user_namespaces:var:1 - - - - oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_user_max_user_namespaces:ste:1 - - - - oval:ssg-object_static_etc_sysctls_sysctl_user_max_user_namespaces:obj:1 - oval:ssg-object_static_run_usr_sysctls_sysctl_user_max_user_namespaces:obj:1 - - - - - oval:ssg-object_static_sysctl_sysctl_user_max_user_namespaces:obj:1 - oval:ssg-object_static_etc_sysctld_sysctl_user_max_user_namespaces:obj:1 - - - - - oval:ssg-object_static_run_sysctld_sysctl_user_max_user_namespaces:obj:1 - - - - /etc/sysctl.conf - ^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /etc/sysctl.d - ^.*\.conf$ - ^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$ - 1 - - - /run/sysctl.d - ^.*\.conf$ - ^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$ - 1 - - - ^/boot/loader/entries/.*.conf - ^options (.*)$ - 1 - - - ^/etc/kernel/cmdline - ^(.*)$ - 1 - - - ^/boot/loader/entries/.*.conf - ^options (.*)$ - 1 - - - ^/etc/kernel/cmdline - ^(.*)$ - 1 - - - ^/boot/loader/entries/.*.conf - ^options (.*)$ - 1 - - - ^/etc/kernel/cmdline - ^(.*)$ - 1 - - - ^/boot/loader/entries/.*.conf - ^options (.*)$ - 1 - - - ^/etc/kernel/cmdline - ^(.*)$ - 1 - - - ^/boot/loader/entries/.*.conf - ^options (.*)$ - 1 - - - ^/etc/kernel/cmdline - ^(.*)$ - 1 - - - /etc/pam.d/system-auth - ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_faillock\.so.*$ - 1 - - - - ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$ - 1 - - - /usr/lib/systemd/system/auditd.service - ^ExecStartPost=\-\/sbin\/auditctl.*$ - 1 - - - /usr/lib/systemd/system/auditd.service - ^(ExecStartPost=\-\/sbin\/augenrules.*$|Requires=augenrules.service) - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/audit.rules - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - 1 - - - /etc/audit/auditd.conf - ^(log_file\s*=\s*.*)$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*log_group[ ]+=[ ]+root[ ]*$ - 1 - - - /etc/audit/auditd.conf - ^[ ]*log_group[ ]+=.*$ - 1 - - - /etc/default/grub - ^\s*GRUB_DISABLE_RECOVERY=(.*)$ - 1 - - - ^/etc/chrony\.(conf|d/.+\.conf)$ - ^([\s]*server[\s]+.+$){2,}$ - 1 - - - /etc/default/grub - ^\s*GRUB_CMDLINE_LINUX_DEFAULT=.*$ - 1 - - - /boot/loader/entries/ - ^.*\.conf$ - ^options(?:\s+.*)?\s+\$kernelopts\b.*$ - 1 - - - alinux-release - - - alinux-release - - - centos-release - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/debian_version - - - /etc/debian_version - ^10.[0-9]+$ - 1 - - - /etc/debian_version - ^11.[0-9]+$ - 1 - - - /etc/debian_version - ^9.[0-9]+$ - 1 - - - fedora-release.* - - - /etc/system-release-cpe - ^cpe:\/o:fedoraproject:fedora:[\d]+$ - 1 - - - oraclelinux-release - - - oraclelinux-release - - - oraclelinux-release - - - openSUSE-release - - - openSUSE-release - - - openSUSE-release - - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)\.\d+"$ - 1 - - - - redhat-release-client - - - redhat-release-workstation - - - redhat-release-server - - - redhat-release-computenode - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - redhat-release-virtualization-host - - - sl-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - /etc/lsb-release - - - /etc/lsb-release - ^DISTRIB_ID=Ubuntu$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=xenial$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=bionic$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=focal$ - 1 - - - uos-release - - - rhvm-appliance - - - audit - - - chrony - - - gdm - - - grub2-common - - - /sys/firmware/opal - - - libuser - - - shadow-utils - - - net-snmp - - - nss-pam-ldapd - - - ntp - - - ovirt-host - - - ovirt-engine - - - pam - - - polkit - - - postfix - - - sssd-common - - - sudo - - - systemd - - - tftp-server - - - tmux - - - usbguard - - - /proc/net/wireless - - - yum - - - s390utils-base - - - /.dockerenv - - - /run/.containerenv - - - krb5-server - - - krb5-workstation - - - /etc/fstab - - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - - - - oval:ssg-sshd_required:var:1 - - - oval:ssg-sshd_required:var:1 - - - oval:ssg-sshd_required:var:1 - - - openssh-server - - - /etc/sssd/sssd.conf - ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$ - 1 - - - /sys/firmware/efi - - - - - - - - - - /etc/tmux.conf - - - ^/etc/usbguard/(rules|rules\.d/.*)\.conf$ - ^.*\S+.*$ - 1 - - - oval:ssg-var_accounts_user_umask_umask_as_number:var:1 - - - oval:ssg-var_removable_partition:var:1 - - - oval:ssg-var_umask_for_daemons_umask_as_number:var:1 - - - - - - - - (?i)root - - - 0 - - - 0 - - - - - - maxpoll \d+ - - - symbolic link - - - /etc/ssh - .*_key$ - 0 - 0 - false - false - false - false - false - false - false - false - false - false - - - /etc/ssh - .*_key$ - - 0 - false - false - false - false - false - false - false - false - false - - - - - - - - - 0 - - - - - - - - - 0 - - - - - - 0 - - - - - - 0 - - - 10 - - - 30 - - - 100 - - - - - - sssd - - - ^LinuxAudit$ - - - - - - /etc/systemd/system/ctrl-alt-del.target - /dev/null - - - 0 - - - 900 - - - - - - -1 - - - - - - - - - - - - - - - - - - ^[x*]$ - - - - - - 0 - - - 0 - - - - - - - - - - - - - - - - - - - - - directory - false - false - false - false - false - false - false - false - false - - - directory - false - false - false - false - false - false - false - false - false - - - - - - 1000 - - - directory - false - false - false - false - false - false - false - - - true - true - - - symbolic link - - - ^[:\.] - - - :: - - - \.\. - - - [:\.]$ - - - ^[^/] - - - [^\\]:[^/] - - - - - - - - - - - - - - - true - true - true - true - true - true - true - - - true - true - true - true - true - true - true - true - true - - - 0 - 0 - - - 0 - 0 - - - true - true - true - true - true - true - true - true - true - - - true - true - true - true - true - true - true - true - true - true - - - true - true - - - ^\/(dev|proc|sys)\/.*$ - - - - - - - - - - - - - - - - - - - - - - - - - - - SYSLOG - - - SINGLE - - - HALT - - - - - - SYSLOG - - - SINGLE - - - HALT - - - - - - - - - - - - - - - - - - syslog - - - keep_logs - - - - - - - - - - - - ^(?i)(syslog|single|halt)(?-i)$ - - - - - - - - - - - - - - - - - - - - - - - - \bsystemd.debug-shell\b - - - \bsystemd.debug-shell\b - - - (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) - - - regular - 0 - - - (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) - - - regular - 0 - - - (?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*) - - - regular - false - false - false - false - false - false - false - - - ResultActive=auth_admin - - - UP - - - false - true - - - 0 - - - false - false - false - false - false - false - false - false - false - false - - - regular - true - - - ^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$ - - - ^/proc/.*$ - - - ^/sys/.*$ - - - 0 - - - true - true - - - symbolic link - - - ^.*\bnousb\b.*$ - - - ^/dev/.*$ - nodev - - - ^(?i)0(?-i)$ - - - ^(?i)none(?-i)$ - - - 0 - - - 0 - - - unconfined_service_t - - - - - - - - - \blm\b - - - ^(x86_64|aarch64|ppc64le|s390x)$ - - - ^false$ - - - - - - - - - - - - - - - /etc/crypto-policies/back-ends/krb5.config - - - ^TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$ - - - ^final all$ - - - ^512M 1h$ - - - ^no$ - - - ^aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc$ - - - ^ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256$ - - - ^hmac-sha2-512,hmac-sha2-256$ - - - ^ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1$ - - - ^'-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'$ - - - fips - - - ^FIPS(:(OSPP|NO-SHA1|NO-CAMELLIA))?$ - - - ^.*fips=1.*$ - - - fail - - - fail - - - fail - - - 4ae0493b - fd431d51 - - - - - - - ## Unsuccessful file access (any other opens) This has to go last. --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access - - - - ## Successful file access (any other opens) This has to go last. -## These next two are likely to result in a whole lot of events --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access - - - - ## First rule - delete all --D - -## Increase the buffers to survive stress events. -## Make this bigger for busy systems --b 8192 - -## This determine how long to wait in burst of events ---backlog_wait_time 60000 - -## Set failure mode to syslog --f 1 - - - - - ## Unsuccessful file creation (open with O_CREAT) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create - - - - ## Successful file creation (open with O_CREAT) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create - - - - ## Unsuccessful file delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - - - - ## Successful file delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete - - - - ## Make the loginuid immutable. This prevents tampering with the auid. ---loginuid-immutable - - - - - ## Unsuccessful file modifications (open for write or truncate) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification - - - - ## Successful file modifications (open for write or truncate) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification - - - - ## These rules watch for kernel module insertion. By monitoring -## the syscall, we do not need any watches on programs. --a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load --a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load --a always,exit -F arch=b32 -S delete_module -F key=module-unload --a always,exit -F arch=b64 -S delete_module -F key=module-unload - - - - ## The purpose of these rules is to meet the requirements for Operating -## System Protection Profile (OSPP)v4.2. These rules depends on having -## the following rule files copied to /etc/audit/rules.d: -## -## 10-base-config.rules, 11-loginuid.rules, -## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, -## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, -## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, -## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, -## 30-ospp-v42-5-perm-change-failed.rules, -## 30-ospp-v42-5-perm-change-success.rules, -## 30-ospp-v42-6-owner-change-failed.rules, -## 30-ospp-v42-6-owner-change-success.rules -## -## original copies may be found in /usr/share/audit/sample-rules/ - - -## User add delete modify. This is covered by pam. However, someone could -## open a file and directly create or modify a user, so we'll watch passwd and -## shadow for writes --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - -## User enable and disable. This is entirely handled by pam. - -## Group add delete modify. This is covered by pam. However, someone could -## open a file and directly create or modify a user, so we'll watch group and -## gshadow for writes --a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify --a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify - - -## Use of special rights for config changes. This would be use of setuid -## programs that relate to user accts. This is not all setuid apps because -## requirements are only for ones that affect system configuration. --a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes - -## Privilege escalation via su or sudo. This is entirely handled by pam. - -## Watch for configuration changes to privilege escalation. --a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes --a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes - -## Audit log access --a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -## Attempts to Alter Process and Session Initiation Information --a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session --a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session --a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session - -## Attempts to modify MAC controls --a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy - -## Software updates. This is entirely handled by rpm. - -## System start and shutdown. This is entirely handled by systemd - -## Kernel Module loading. This is handled in 43-module-load.rules - -## Application invocation. The requirements list an optional requirement -## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to -## state results from that policy. This would be handled entirely by -## that daemon. - - - - - ## Unsuccessful ownership change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change - - - - ## Successful ownership change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change - - - - ## Unsuccessful permission change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change - - - - ## Successful permission change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change - - - - ^(?i)50(?-i)$ - - - ^(?i)yes(?-i)$ - - - ^(?i)ENRICHED(?-i)$ - - - ^(?i)hostname(?-i)$ - - - ^(?i)yes(?-i)$ - - - ^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$ - - - ^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$ - - - ^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$ - - - ^(?:.*\s)?audit=1(?:\s.*)?$ - - - ^(?:.*\s)?audit=1(?:\s.*)?$ - - - ^(?:.*\s)?audit=1(?:\s.*)?$ - - - ^(?:.*\s)?systemd.confirm_spawn=(?:1|yes|true|on)(?:\s.*)?$ - - - ^(?:.*\s)?systemd.confirm_spawn=(?:1|yes|true|on)(?:\s.*)?$ - - - ^(?:.*\s)?systemd.confirm_spawn=(?:1|yes|true|on)(?:\s.*)?$ - - - ^(?:.*\s)?selinux=0(?:\s.*)?$ - - - ^(?:.*\s)?selinux=0(?:\s.*)?$ - - - ^(?:.*\s)?selinux=0(?:\s.*)?$ - - - ^(?:.*\s)?nousb(?:\s.*)?$ - - - ^(?:.*\s)?nousb(?:\s.*)?$ - - - ^(?:.*\s)?nousb(?:\s.*)?$ - - - ^(?:.*\s)?page_poison=1(?:\s.*)?$ - - - ^(?:.*\s)?page_poison=1(?:\s.*)?$ - - - ^(?:.*\s)?page_poison=1(?:\s.*)?$ - - - ^(?:.*\s)?pti=on(?:\s.*)?$ - - - ^(?:.*\s)?pti=on(?:\s.*)?$ - - - ^(?:.*\s)?pti=on(?:\s.*)?$ - - - ^(?:.*\s)?slub_debug=P(?:\s.*)?$ - - - ^(?:.*\s)?slub_debug=P(?:\s.*)?$ - - - ^(?:.*\s)?slub_debug=P(?:\s.*)?$ - - - ^(?:.*\s)?vsyscall=none(?:\s.*)?$ - - - ^(?:.*\s)?vsyscall=none(?:\s.*)?$ - - - ^(?:.*\s)?vsyscall=none(?:\s.*)?$ - - - 0 - - - 0 - - - 0 - - - 0 - - - 0 - - - 0 - - - symbolic link - - - 0 - - - 0 - - - 0 - - - 0 - - - symbolic link - - - false - false - false - false - false - - - false - false - false - false - false - - - false - false - false - false - false - - - false - false - false - false - false - - - false - false - false - false - false - - - false - false - false - false - false - - - symbolic link - - - false - false - - - false - false - - - false - false - - - false - false - - - symbolic link - - - ^no$ - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 4 - - - symbolic link - - - 0 - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 0 - - - symbolic link - - - 104 - - - symbolic link - - - 0 - - - 0 - - - symbolic link - - - 0 - - - 0 - - - 0 - - - 0 - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - - - false - false - - - false - false - - - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - false - - - symbolic link - - - false - false - false - false - false - false - false - false - false - - - symbolic link - - - ^(?:.*\s)?iommu=force(?:\s.*)?$ - - - ^(?:.*\s)?ipv6\.disable=1(?:\s.*)?$ - - - - - - ^(?:.*\s)?mce=0(?:\s.*)?$ - - - - - - ^(?:.*\s)?slab_nomerge=yes(?:\s.*)?$ - - - - - - ^(?:.*\s)?spectre_v2=on(?:\s.*)?$ - - - n - - - - - - n - - - - - - y - - - - - - n - - - - - - n - - - - - - y - - - - - - n - - - - - - y - - - - - - y - - - - - - y - - - - - - 65536 - - - - - - n - - - - - - n - - - - - - n - - - - - - n - - - - - - n - - - - - - n - - - - - - y - - - - - - y - - - - - - y - - - - - - - - - - - - - - - - - - y - - - - - - y - - - - - - y - - - - - - y - - - - - - y - - - - - - - - - - - - n - - - - - - y - - - - - - y - - - - - - y - - - - - - y - - - - - - y - - - - - - y - - - - - - n - - - - - - y - - - - - - y - - - - - - y - - - - - - y - - - - - - y - - - - - - n - - - - - - nodev - - - nosuid - - - nodev - - - noexec - - - nosuid - - - nodev - - - nosuid - - - ^.*,?nodev,?.*$ - - - ^.*,?nodev,?.* - - - ^.*,?noexec,?.*$ - - - ^.*,?noexec,?.* - - - ^.*,?nosuid,?.*$ - - - ^.*,?nosuid,?.* - - - nodev - - - noexec - - - nosuid - - - nodev - - - noexec - - - nosuid - - - nodev - - - noexec - - - nosuid - - - nodev - - - nosuid - - - nodev - - - noexec - - - nosuid - - - auditd.service - - - auditd.socket - - - active - - - inactive|failed - - - masked - - - inactive|failed - - - masked - - - chronyd.service - - - chronyd.socket - - - active - - - cron.service - - - cron.socket - - - active - - - inactive|failed - - - masked - - - fapolicyd.service - - - fapolicyd.socket - - - active - - - firewalld.service - - - firewalld.socket - - - active - - - ip6tables.service - - - ip6tables.socket - - - active - - - iptables.service - - - iptables.socket - - - active - - - inactive|failed - - - masked - - - ntp.service - - - ntp.socket - - - active - - - ntpd.service - - - ntpd.socket - - - active - - - rngd.service - - - rngd.socket - - - active - - - rsyslog.service - - - rsyslog.socket - - - active - - - inactive|failed - - - masked - - - inactive|failed - - - masked - - - syslog-ng.service - - - syslog-ng.socket - - - active - - - inactive|failed - - - masked - - - systemd-journald.service - - - systemd-journald.socket - - - active - - - ufw.service - - - ufw.socket - - - active - - - usbguard.service - - - usbguard.socket - - - active - - - ^no$ - - - ^no$ - - - ^no$ - - - ^no$ - - - ^yes$ - - - ^no$ - - - ^prohibit-password$ - - - ^no$ - - - ^yes$ - - - ^no$ - - - ^no$ - - - ^yes$ - - - ^yes$ - - - ^yes$ - - - ^yes$ - - - ^/etc/issue$ - - - ^/etc/issue.net$ - - - ^yes$ - - - ^yes$ - - - ^0$ - - - ^INFO$ - - - ^VERBOSE$ - - - - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - |/bin/false - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - |/bin/false - - - '' - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - '' - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - 2 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 2 - - - 2 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 2 - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - 2 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 2 - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - - - - 1 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 1 - - - 0 - - - 1 - - - - - - ^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$ - - - 0 - - - ^(?:.*\s)?audit=1(?:\s.*)?$ - - - ^(?:.*\s)?audit=1(?:\s.*)?$ - - - ^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$ - - - ^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$ - - - ^(?:.*\s)?page_poison=1(?:\s.*)?$ - - - ^(?:.*\s)?page_poison=1(?:\s.*)?$ - - - ^(?:.*\s)?slub_debug=P(?:\s.*)?$ - - - ^(?:.*\s)?slub_debug=P(?:\s.*)?$ - - - ^(?:.*\s)?vsyscall=none(?:\s.*)?$ - - - ^(?:.*\s)?vsyscall=none(?:\s.*)?$ - - - ^(true|"true")$ - - - ^2.*$ - - - ^3.*$ - - - ^7.*$ - - - centos - - - 8 - - - centos - - - 9 - - - ^7.*$ - - - ^8.*$ - - - ^9.*$ - - - openSUSE-release - - - ^15.*$ - - - ^42.*$ - - - unix - - - rhcos - - - 4 - - - unix - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - 7 - - - unix - - - ^8.*$ - - - ^8.0*$ - - - ^8.1*$ - - - ^8.2*$ - - - ^8.3*$ - - - ^8.4*$ - - - ^8.5*$ - - - ^8.6*$ - - - ^8.7*$ - - - ^8.8*$ - - - ^8.9*$ - - - ^8.10*$ - - - 8 - - - unix - - - ^9.*$ - - - 9 - - - 0:4.4 - - - ^7.*$ - - - unix - - - ^12.*$ - - - ^12.*$ - - - ^12.*$ - - - unix - - - ^15.*$ - - - ^15.*$ - - - ^15.*$ - - - ^20.*$ - - - ^4.*$ - - - 0:1.17-18 - - - 0:1.17-18 - - - ^aarch64$ - - - ^ppc64le$ - - - ^s390x$ - - - 1 - - - 2 - - - 0 - - - 0:7.4 - - - aarch64 - - - ppc64 - - - ppc64le - - - s390x - - - i686 - - - x86_64 - - - true - - - /dev/cdrom - - - - - - - - - - - ^[\s]*RekeyLimit[\s]+ - - [\s]+ - - [\s]*$ - - - - - - - - ^[\s]*RekeyLimit[\s]+ - - [\s]+ - - [\s]*$ - - - - - - - - - - - - - ^[\s]*auth[\s]+(?:required|requisite)[\s]+pam_faillock.so[^\n#]preauth[^\n#]*audit - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (?i) - - - - - - - (?i) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^/etc/rsyslog.conf$ - - - - - - - - - - - - - - - - ^/etc/rsyslog.conf$ - - - - - - - - - - - - - - - - ^/etc/rsyslog.conf$ - - - - - - - - - - - - - - - - - - - - - - - - - - - / - - - - - - - / - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - (?:[^.]|\.\s)* - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - (?:[^.]|\.\s)* - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - (?:[^.]|\.\s)* - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - (?:[^.]|\.\s)* - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a1&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a1&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - (?:[^.]|\.\s)* - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - (?:[^.]|\.\s)* - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+ - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+ - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+a2&0100)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+a2&01003)[\s]+(?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - - ^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $\n(^(?! - - | - - ).*$\n)*^ - - $ - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* - - - [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - - (?:-F\s+exit=-EACCES) - - - - - - - (?:-F\s+exit=-EPERM) - - - - - - ^(?:.*\s)?l1tf= - - (?:\s.*)?$ - - - - - - ^(?:.*\s)?rng_core.default_quality= - - (?:\s.*)?$ - - - - - - ^(?:.*\s)?spec_store_bypass_disable= - - (?:\s.*)?$ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /etc/modprobe.d - /etc/modules-load.d - /run/modprobe.d - /run/modules-load.d - /usr/lib/modprobe.d - /usr/lib/modules-load.d - - - /dev/cdrom - /dev/dvd - /dev/scd0 - /dev/sr0 - - - - ^[\s]* - - [\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$ - - - - - ^[\s]* - - [\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$ - - - - - /dev/cdrom - /dev/dvd - /dev/scd0 - /dev/sr0 - - - - ^[\s]* - - [\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$ - - - - - ^[\s]* - - [\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$ - - - - /dev/cdrom - /dev/dvd - /dev/scd0 - /dev/sr0 - - - - ^[\s]* - - [\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$ - - - - - ^[\s]* - - [\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /etc/pam.d/system-auth - - - - - - - - /dev/cdrom - /dev/dvd - /dev/scd0 - /dev/sr0 - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - - - - - - - - - - - - - - - - - - - 64 - - - - 8 - - - - - - - - - - - - build_shorthand.py from SCAP Security Guide - ssg: 0.1.64 - 2.0 - 2022-08-11T18:55:23 - - - - Enable cron Service - - ocil:ssg-service_cron_enabled_action:testaction:1 - - - - Uninstall bind Package - - ocil:ssg-package_bind_removed_action:testaction:1 - - - - fapolicyd Must be Configured to Limit Access to Users Home Folders - - ocil:ssg-fapolicyd_prevent_home_folder_access_action:testaction:1 - - - - Install fapolicyd Package - - ocil:ssg-package_fapolicyd_installed_action:testaction:1 - - - - Enable the File Access Policy Service - - ocil:ssg-service_fapolicyd_enabled_action:testaction:1 - - - - Disable Kerberos by removing host keytab - - ocil:ssg-kerberos_disable_no_keytab_action:testaction:1 - - - - Ensure LDAP client is not installed - - ocil:ssg-package_openldap-clients_removed_action:testaction:1 - - - - Configure System to Forward All Mail For The Root Account - - ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1 - - - - Configure System to Forward All Mail From Postmaster to The Root Account - - ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1 - - - - Configure System to Forward All Mail through a specific host - - ocil:ssg-postfix_client_configure_relayhost_action:testaction:1 - - - - The Postfix package is installed - - ocil:ssg-package_postfix_installed_action:testaction:1 - - - - Uninstall Sendmail Package - - ocil:ssg-package_sendmail_removed_action:testaction:1 - - - - Ensure All-Squashing Disabled On All Exports - - ocil:ssg-no_all_squash_exports_action:testaction:1 - - - - Disable chrony daemon from acting as server - - ocil:ssg-chronyd_client_only_action:testaction:1 - - - - Disable network management of chrony daemon - - ocil:ssg-chronyd_no_chronyc_network_action:testaction:1 - - - - Configure Time Service Maxpoll Interval - - ocil:ssg-chronyd_or_ntpd_set_maxpoll_action:testaction:1 - - - - Specify a Remote NTP Server - - ocil:ssg-chronyd_or_ntpd_specify_remote_server_action:testaction:1 - - - - Ensure Chrony is only configured with the server directive - - ocil:ssg-chronyd_server_directive_action:testaction:1 - - - - A remote time server for Chrony is configured - - ocil:ssg-chronyd_specify_remote_server_action:testaction:1 - - - - Specify a Remote NTP Server - - ocil:ssg-ntpd_specify_remote_server_action:testaction:1 - - - - The Chrony package is installed - - ocil:ssg-package_chrony_installed_action:testaction:1 - - - - Install the ntp service - - ocil:ssg-package_ntp_installed_action:testaction:1 - - - - The Chronyd service is enabled - - ocil:ssg-service_chronyd_enabled_action:testaction:1 - - - - Enable the NTP Daemon - - ocil:ssg-service_chronyd_or_ntpd_enabled_action:testaction:1 - - - - Enable the NTP Daemon - - ocil:ssg-service_ntp_enabled_action:testaction:1 - - - - Enable the NTP Daemon - - ocil:ssg-service_ntpd_enabled_action:testaction:1 - - - - Remove Rsh Trust Files - - ocil:ssg-no_rsh_trust_files_action:testaction:1 - - - - Enable the Hardware RNG Entropy Gatherer Service - - ocil:ssg-service_rngd_enabled_action:testaction:1 - - - - Install the Samba Common Package - - ocil:ssg-package_samba-common_installed_action:testaction:1 - - - - Uninstall net-snmp Package - - ocil:ssg-package_net-snmp_removed_action:testaction:1 - - - - Configure session renegotiation for SSH client - - ocil:ssg-ssh_client_rekey_limit_action:testaction:1 - - - - Disable Host-Based Authentication - - ocil:ssg-disable_host_auth_action:testaction:1 - - - - Allow Only SSH Protocol 2 - - ocil:ssg-sshd_allow_only_protocol2_action:testaction:1 - - - - Disable Compression Or Set Compression to delayed - - ocil:ssg-sshd_disable_compression_action:testaction:1 - - - - Disable SSH Access via Empty Passwords - - ocil:ssg-sshd_disable_empty_passwords_action:testaction:1 - - - - Disable GSSAPI Authentication - - ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1 - - - - Disable Kerberos Authentication - - ocil:ssg-sshd_disable_kerb_auth_action:testaction:1 - - - - Disable PubkeyAuthentication Authentication - - ocil:ssg-sshd_disable_pubkey_auth_action:testaction:1 - - - - Disable SSH Support for .rhosts Files - - ocil:ssg-sshd_disable_rhosts_action:testaction:1 - - - - Disable SSH Support for Rhosts RSA Authentication - - ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1 - - - - Disable SSH Root Login - - ocil:ssg-sshd_disable_root_login_action:testaction:1 - - - - Disable SSH root Login with a Password (Insecure) - - ocil:ssg-sshd_disable_root_password_login_action:testaction:1 - - - - Disable SSH TCP Forwarding - - ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1 - - - - Disable SSH Support for User Known Hosts - - ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1 - - - - Disable X11 Forwarding - - ocil:ssg-sshd_disable_x11_forwarding_action:testaction:1 - - - - Do Not Allow SSH Environment Options - - ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1 - - - - Enable GSSAPI Authentication - - ocil:ssg-sshd_enable_gssapi_auth_action:testaction:1 - - - - Enable PAM - - ocil:ssg-sshd_enable_pam_action:testaction:1 - - - - Enable Public Key Authentication - - ocil:ssg-sshd_enable_pubkey_auth_action:testaction:1 - - - - Enable Use of Strict Mode Checking - - ocil:ssg-sshd_enable_strictmodes_action:testaction:1 - - - - Enable SSH Warning Banner - - ocil:ssg-sshd_enable_warning_banner_action:testaction:1 - - - - Enable SSH Warning Banner - - ocil:ssg-sshd_enable_warning_banner_net_action:testaction:1 - - - - Enable Encrypted X11 Forwarding - - ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1 - - - - Limit Users' SSH Access - - ocil:ssg-sshd_limit_user_access_action:testaction:1 - - - - Enable SSH Print Last Log - - ocil:ssg-sshd_print_last_log_action:testaction:1 - - - - Force frequent session key renegotiation - - ocil:ssg-sshd_rekey_limit_action:testaction:1 - - - - Set SSH Idle Timeout Interval - - ocil:ssg-sshd_set_idle_timeout_action:testaction:1 - - - - Set SSH Client Alive Count Max - - ocil:ssg-sshd_set_keepalive_action:testaction:1 - - - - Set SSH Client Alive Count Max to zero - - ocil:ssg-sshd_set_keepalive_0_action:testaction:1 - - - - Ensure SSH LoginGraceTime is configured - - ocil:ssg-sshd_set_login_grace_time_action:testaction:1 - - - - Set LogLevel to INFO - - ocil:ssg-sshd_set_loglevel_info_action:testaction:1 - - - - Set SSH Daemon LogLevel to VERBOSE - - ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1 - - - - Set SSH authentication attempt limit - - ocil:ssg-sshd_set_max_auth_tries_action:testaction:1 - - - - Set SSH MaxSessions limit - - ocil:ssg-sshd_set_max_sessions_action:testaction:1 - - - - Ensure SSH MaxStartups is configured - - ocil:ssg-sshd_set_maxstartups_action:testaction:1 - - - - Enable Use of Privilege Separation - - ocil:ssg-sshd_use_priv_separation_action:testaction:1 - - - - Verify Group Who Owns SSH Server config file - - ocil:ssg-file_groupowner_sshd_config_action:testaction:1 - - - - Verify Owner on SSH Server config file - - ocil:ssg-file_owner_sshd_config_action:testaction:1 - - - - Verify Permissions on SSH Server config file - - ocil:ssg-file_permissions_sshd_config_action:testaction:1 - - - - Verify Permissions on SSH Server Private *_key Key Files - - ocil:ssg-file_permissions_sshd_private_key_action:testaction:1 - - - - Verify Permissions on SSH Server Public *.pub Key Files - - ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1 - - - - Install the OpenSSH Server Package - - ocil:ssg-package_openssh-server_installed_action:testaction:1 - - - - Remove the OpenSSH Server Package - - ocil:ssg-package_openssh-server_removed_action:testaction:1 - - - - Enable Smartcards in SSSD - - ocil:ssg-sssd_enable_smartcards_action:testaction:1 - - - - Configure SSSD to Expire Offline Credentials - - ocil:ssg-sssd_offline_cred_expiration_action:testaction:1 - - - - Configure SSSD to run as user sssd - - ocil:ssg-sssd_run_as_sssd_user_action:testaction:1 - - - - Log USBGuard daemon audit events using Linux Audit - - ocil:ssg-configure_usbguard_auditbackend_action:testaction:1 - - - - Install usbguard Package - - ocil:ssg-package_usbguard_installed_action:testaction:1 - - - - Enable the USBGuard Service - - ocil:ssg-service_usbguard_enabled_action:testaction:1 - - - - Authorize Human Interface Devices in USBGuard daemon - - ocil:ssg-usbguard_allow_hid_action:testaction:1 - - - - Authorize Human Interface Devices and USB hubs in USBGuard daemon - - ocil:ssg-usbguard_allow_hid_and_hub_action:testaction:1 - - - - Authorize USB hubs in USBGuard daemon - - ocil:ssg-usbguard_allow_hub_action:testaction:1 - - - - Modify the System Login Banner - - ocil:ssg-banner_etc_issue_action:testaction:1 - - - - Verify Group Ownership of System Login Banner - - ocil:ssg-file_groupowner_etc_issue_action:testaction:1 - - - - Verify ownership of System Login Banner - - ocil:ssg-file_owner_etc_issue_action:testaction:1 - - - - Verify permissions on System Login Banner - - ocil:ssg-file_permissions_etc_issue_action:testaction:1 - - - - Account Lockouts Must Be Logged - - ocil:ssg-account_passwords_pam_faillock_audit_action:testaction:1 - - - - Account Lockouts Must Persist - - ocil:ssg-account_passwords_pam_faillock_dir_action:testaction:1 - - - - Disallow Configuration to Bypass Password Requirements for Privilege Escalation - - ocil:ssg-disallow_bypass_password_sudo_action:testaction:1 - - - - Ensure PAM Displays Last Logon/Access Notification - - ocil:ssg-display_login_attempts_action:testaction:1 - - - - Support session locking with tmux - - ocil:ssg-configure_bashrc_exec_tmux_action:testaction:1 - - - - Configure tmux to lock session after inactivity - - ocil:ssg-configure_tmux_lock_after_time_action:testaction:1 - - - - Configure the tmux Lock Command - - ocil:ssg-configure_tmux_lock_command_action:testaction:1 - - - - Prevent user from disabling the screen lock - - ocil:ssg-no_tmux_in_shells_action:testaction:1 - - - - Install the tmux Package - - ocil:ssg-package_tmux_installed_action:testaction:1 - - - - Verify that Interactive Boot is Disabled - - ocil:ssg-coreos_disable_interactive_boot_action:testaction:1 - - - - Disable Ctrl-Alt-Del Burst Action - - ocil:ssg-disable_ctrlaltdel_burstaction_action:testaction:1 - - - - Disable Ctrl-Alt-Del Reboot Activation - - ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1 - - - - Verify that Interactive Boot is Disabled - - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 - - - - Require Authentication for Single User Mode - - ocil:ssg-require_singleuser_auth_action:testaction:1 - - - - Disable debug-shell SystemD Service - - ocil:ssg-service_debug-shell_disabled_action:testaction:1 - - - - Set Account Expiration Following Inactivity - - ocil:ssg-account_disable_post_pw_expiration_action:testaction:1 - - - - Ensure All Accounts on the System Have Unique Names - - ocil:ssg-account_unique_name_action:testaction:1 - - - - Use Centralized and Automated Authentication - - ocil:ssg-account_use_centralized_automated_auth_action:testaction:1 - - - - Set Password Maximum Age - - ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1 - - - - Set Password Minimum Age - - ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1 - - - - Set Password Minimum Length in login.defs - - ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1 - - - - Set Password Warning Age - - ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1 - - - - Verify All Account Password Hashes are Shadowed - - ocil:ssg-accounts_password_all_shadowed_action:testaction:1 - - - - All GIDs referenced in /etc/passwd must be defined in /etc/group - - ocil:ssg-gid_passwd_group_same_action:testaction:1 - - - - Prevent Login to Accounts With Empty Password - - ocil:ssg-no_empty_passwords_action:testaction:1 - - - - Ensure There Are No Accounts With Blank or Null Passwords - - ocil:ssg-no_empty_passwords_etc_shadow_action:testaction:1 - - - - Ensure there are no legacy + NIS entries in /etc/group - - ocil:ssg-no_legacy_plus_entries_etc_group_action:testaction:1 - - - - Ensure there are no legacy + NIS entries in /etc/passwd - - ocil:ssg-no_legacy_plus_entries_etc_passwd_action:testaction:1 - - - - Ensure there are no legacy + NIS entries in /etc/shadow - - ocil:ssg-no_legacy_plus_entries_etc_shadow_action:testaction:1 - - - - Verify No netrc Files Exist - - ocil:ssg-no_netrc_files_action:testaction:1 - - - - Verify Only Root Has UID 0 - - ocil:ssg-accounts_no_uid_except_zero_action:testaction:1 - - - - Verify Root Has A Primary GID 0 - - ocil:ssg-accounts_root_gid_zero_action:testaction:1 - - - - Direct root Logins Not Allowed - - ocil:ssg-no_direct_root_logins_action:testaction:1 - - - - Ensure that System Accounts Are Locked - - ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1 - - - - Ensure that System Accounts Do Not Run a Shell Upon Login - - ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1 - - - - Restrict Serial Port Root Logins - - ocil:ssg-restrict_serial_port_logins_action:testaction:1 - - - - Restrict Virtual Console Root Logins - - ocil:ssg-securetty_root_login_console_only_action:testaction:1 - - - - Ensure that Root's Path Does Not Include World or Group-Writable Directories - - ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1 - - - - Ensure the Default Bash Umask is Set Correctly - - ocil:ssg-accounts_umask_etc_bashrc_action:testaction:1 - - - - Ensure the Default C Shell Umask is Set Correctly - - ocil:ssg-accounts_umask_etc_csh_cshrc_action:testaction:1 - - - - Ensure the Default Umask is Set Correctly in login.defs - - ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1 - - - - Ensure the Default Umask is Set Correctly in /etc/profile - - ocil:ssg-accounts_umask_etc_profile_action:testaction:1 - - - - Ensure the Logon Failure Delay is Set Correctly in login.defs - - ocil:ssg-accounts_logon_fail_delay_action:testaction:1 - - - - Limit the Number of Concurrent Login Sessions Allowed Per User - - ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1 - - - - Configure Polyinstantiation of /tmp Directories - - ocil:ssg-accounts_polyinstantiated_tmp_action:testaction:1 - - - - Configure Polyinstantiation of /var/tmp Directories - - ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1 - - - - Set Interactive Session Timeout - - ocil:ssg-accounts_tmout_action:testaction:1 - - - - Ensure that User Home Directories are not Group-Writable or World-Readable - - ocil:ssg-file_permissions_home_dirs_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - chmod - - ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - chown - - ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - fchmod - - ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - fchmodat - - ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - fchown - - ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - fchownat - - ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - fremovexattr - - ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - fsetxattr - - ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - lchown - - ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - lremovexattr - - ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - lsetxattr - - ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - removexattr - - ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - setxattr - - ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - umount - - ocil:ssg-audit_rules_dac_modification_umount_action:testaction:1 - - - - Record Events that Modify the System's Discretionary Access Controls - umount2 - - ocil:ssg-audit_rules_dac_modification_umount2_action:testaction:1 - - - - Record Any Attempts to Run chcon - - ocil:ssg-audit_rules_execution_chcon_action:testaction:1 - - - - Record Any Attempts to Run restorecon - - ocil:ssg-audit_rules_execution_restorecon_action:testaction:1 - - - - Record Any Attempts to Run semanage - - ocil:ssg-audit_rules_execution_semanage_action:testaction:1 - - - - Record Any Attempts to Run setfiles - - ocil:ssg-audit_rules_execution_setfiles_action:testaction:1 - - - - Record Any Attempts to Run setsebool - - ocil:ssg-audit_rules_execution_setsebool_action:testaction:1 - - - - Record Any Attempts to Run seunshare - - ocil:ssg-audit_rules_execution_seunshare_action:testaction:1 - - - - Ensure auditd Collects File Deletion Events by User - - ocil:ssg-audit_rules_file_deletion_events_action:testaction:1 - - - - Ensure auditd Collects File Deletion Events by User - rename - - ocil:ssg-audit_rules_file_deletion_events_rename_action:testaction:1 - - - - Ensure auditd Collects File Deletion Events by User - renameat - - ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1 - - - - Ensure auditd Collects File Deletion Events by User - rmdir - - ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1 - - - - Ensure auditd Collects File Deletion Events by User - unlink - - ocil:ssg-audit_rules_file_deletion_events_unlink_action:testaction:1 - - - - Ensure auditd Collects File Deletion Events by User - unlinkat - - ocil:ssg-audit_rules_file_deletion_events_unlinkat_action:testaction:1 - - - - Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) - - ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - chmod - - ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_action:testaction:1 - - - - Record Unsuccessful Ownership Changes to Files - chown - - ocil:ssg-audit_rules_unsuccessful_file_modification_chown_action:testaction:1 - - - - Record Unsuccessful Access Attempts to Files - creat - - ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - fchmod - - ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - fchmodat - - ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_action:testaction:1 - - - - Record Unsuccessful Ownership Changes to Files - fchown - - ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1 - - - - Record Unsuccessful Ownership Changes to Files - fchownat - - ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - fremovexattr - - ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - fsetxattr - - ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1 - - - - Record Unsuccessful Access Attempts to Files - ftruncate - - ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1 - - - - Record Unsuccessful Ownership Changes to Files - lchown - - ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - lremovexattr - - ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - lsetxattr - - ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_action:testaction:1 - - - - Record Unsuccessful Access Attempts to Files - open - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1 - - - - Record Unsuccessful Access Attempts to Files - open_by_handle_at - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - - - Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_action:testaction:1 - - - - Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1 - - - - Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_action:testaction:1 - - - - Record Unsuccessful Creation Attempts to Files - open O_CREAT - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_action:testaction:1 - - - - Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_action:testaction:1 - - - - Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly - - ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_action:testaction:1 - - - - Record Unsuccessful Access Attempts to Files - openat - - ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1 - - - - Record Unsuccessful Creation Attempts to Files - openat O_CREAT - - ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_action:testaction:1 - - - - Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE - - ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_action:testaction:1 - - - - Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly - - ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - removexattr - - ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_action:testaction:1 - - - - Record Unsuccessful Delete Attempts to Files - rename - - ocil:ssg-audit_rules_unsuccessful_file_modification_rename_action:testaction:1 - - - - Record Unsuccessful Delete Attempts to Files - renameat - - ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_action:testaction:1 - - - - Record Unsuccessful Permission Changes to Files - setxattr - - ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_action:testaction:1 - - - - Record Unsuccessful Access Attempts to Files - truncate - - ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1 - - - - Record Unsuccessful Delete Attempts to Files - unlink - - ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_action:testaction:1 - - - - Record Unsuccessful Delete Attempts to Files - unlinkat - - ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_action:testaction:1 - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - - ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - - - Ensure auditd Collects Information on Kernel Module Unloading - delete_module - - ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - - - Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module - - ocil:ssg-audit_rules_kernel_module_loading_finit_action:testaction:1 - - - - Ensure auditd Collects Information on Kernel Module Loading - init_module - - ocil:ssg-audit_rules_kernel_module_loading_init_action:testaction:1 - - - - Record Attempts to Alter Logon and Logout Events - faillock - - ocil:ssg-audit_rules_login_events_faillock_action:testaction:1 - - - - Record Attempts to Alter Logon and Logout Events - lastlog - - ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1 - - - - Record Attempts to Alter Logon and Logout Events - tallylog - - ocil:ssg-audit_rules_login_events_tallylog_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - init - - ocil:ssg-audit_privileged_commands_init_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - poweroff - - ocil:ssg-audit_privileged_commands_poweroff_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - reboot - - ocil:ssg-audit_privileged_commands_reboot_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - shutdown - - ocil:ssg-audit_privileged_commands_shutdown_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - - ocil:ssg-audit_rules_privileged_commands_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - at - - ocil:ssg-audit_rules_privileged_commands_at_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - chage - - ocil:ssg-audit_rules_privileged_commands_chage_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - chsh - - ocil:ssg-audit_rules_privileged_commands_chsh_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - crontab - - ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd - - ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - mount - - ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap - - ocil:ssg-audit_rules_privileged_commands_newgidmap_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newgrp - - ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap - - ocil:ssg-audit_rules_privileged_commands_newuidmap_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check - - ocil:ssg-audit_rules_privileged_commands_pam_timestamp_check_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - passwd - - ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - postdrop - - ocil:ssg-audit_rules_privileged_commands_postdrop_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - postqueue - - ocil:ssg-audit_rules_privileged_commands_postqueue_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown - - ocil:ssg-audit_rules_privileged_commands_pt_chown_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign - - ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - su - - ocil:ssg-audit_rules_privileged_commands_su_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - sudo - - ocil:ssg-audit_rules_privileged_commands_sudo_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit - - ocil:ssg-audit_rules_privileged_commands_sudoedit_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - umount - - ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd - - ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - userhelper - - ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1 - - - - Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl - - ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1 - - - - Record attempts to alter time through adjtimex - - ocil:ssg-audit_rules_time_adjtimex_action:testaction:1 - - - - Record Attempts to Alter Time Through clock_settime - - ocil:ssg-audit_rules_time_clock_settime_action:testaction:1 - - - - Record attempts to alter time through settimeofday - - ocil:ssg-audit_rules_time_settimeofday_action:testaction:1 - - - - Record Attempts to Alter Time Through stime - - ocil:ssg-audit_rules_time_stime_action:testaction:1 - - - - Record Attempts to Alter the localtime File - - ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1 - - - - Record Events that Modify User/Group Information via open syscall - /etc/group - - ocil:ssg-audit_rules_etc_group_open_action:testaction:1 - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group - - ocil:ssg-audit_rules_etc_group_open_by_handle_at_action:testaction:1 - - - - Record Events that Modify User/Group Information via openat syscall - /etc/group - - ocil:ssg-audit_rules_etc_group_openat_action:testaction:1 - - - - Record Events that Modify User/Group Information via open syscall - /etc/gshadow - - ocil:ssg-audit_rules_etc_gshadow_open_action:testaction:1 - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow - - ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_action:testaction:1 - - - - Record Events that Modify User/Group Information via openat syscall - /etc/gshadow - - ocil:ssg-audit_rules_etc_gshadow_openat_action:testaction:1 - - - - Record Events that Modify User/Group Information via open syscall - /etc/passwd - - ocil:ssg-audit_rules_etc_passwd_open_action:testaction:1 - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd - - ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_action:testaction:1 - - - - Record Events that Modify User/Group Information via openat syscall - /etc/passwd - - ocil:ssg-audit_rules_etc_passwd_openat_action:testaction:1 - - - - Record Events that Modify User/Group Information via open syscall - /etc/shadow - - ocil:ssg-audit_rules_etc_shadow_open_action:testaction:1 - - - - Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow - - ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_action:testaction:1 - - - - Record Events that Modify User/Group Information via openat syscall - /etc/shadow - - ocil:ssg-audit_rules_etc_shadow_openat_action:testaction:1 - - - - Make the auditd Configuration Immutable - - ocil:ssg-audit_rules_immutable_action:testaction:1 - - - - Record Events that Modify the System's Mandatory Access Controls - - ocil:ssg-audit_rules_mac_modification_action:testaction:1 - - - - Ensure auditd Collects Information on Exporting to Media (successful) - - ocil:ssg-audit_rules_media_export_action:testaction:1 - - - - Record Events that Modify the System's Network Environment - - ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1 - - - - Ensure auditd Collects System Administrator Actions - - ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1 - - - - Record Events that Modify User/Group Information - - ocil:ssg-audit_rules_usergroup_modification_action:testaction:1 - - - - Record Events that Modify User/Group Information - /etc/group - - ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1 - - - - Record Events that Modify User/Group Information - /etc/gshadow - - ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1 - - - - Record Events that Modify User/Group Information - /etc/security/opasswd - - ocil:ssg-audit_rules_usergroup_modification_opasswd_action:testaction:1 - - - - Record Events that Modify User/Group Information - /etc/passwd - - ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1 - - - - Record Events that Modify User/Group Information - /etc/shadow - - ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1 - - - - Record Access Events to Audit Log Directory - - ocil:ssg-directory_access_var_log_audit_action:testaction:1 - - - - System Audit Logs Must Have Mode 0750 or Less Permissive - - ocil:ssg-directory_permissions_var_log_audit_action:testaction:1 - - - - Audit Configuration Files Must Be Owned By Group root - - ocil:ssg-file_groupownership_audit_configuration_action:testaction:1 - - - - Audit Configuration Files Must Be Owned By Root - - ocil:ssg-file_ownership_audit_configuration_action:testaction:1 - - - - System Audit Logs Must Be Owned By Root - - ocil:ssg-file_ownership_var_log_audit_action:testaction:1 - - - - System Audit Logs Must Have Mode 0640 or Less Permissive - - ocil:ssg-file_permissions_var_log_audit_action:testaction:1 - - - - Configure audispd Plugin To Send Logs To Remote Server - - ocil:ssg-auditd_audispd_configure_remote_server_action:testaction:1 - - - - Configure audispd's Plugin disk_full_action When Disk Is Full - - ocil:ssg-auditd_audispd_disk_full_action_action:testaction:1 - - - - Encrypt Audit Records Sent With audispd Plugin - - ocil:ssg-auditd_audispd_encrypt_sent_records_action:testaction:1 - - - - Configure audispd's Plugin network_failure_action On Network Failure - - ocil:ssg-auditd_audispd_network_failure_action_action:testaction:1 - - - - Configure auditd to use audispd's syslog plugin - - ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1 - - - - Configure auditd Disk Error Action on Disk Error - - ocil:ssg-auditd_data_disk_error_action_action:testaction:1 - - - - Configure auditd Disk Error Action on Disk Error - - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 - - - - Configure auditd Disk Full Action when Disk Space Is Full - - ocil:ssg-auditd_data_disk_full_action_action:testaction:1 - - - - Configure auditd Disk Full Action when Disk Space Is Full - - ocil:ssg-auditd_data_disk_full_action_stig_action:testaction:1 - - - - Configure auditd mail_acct Action on Low Disk Space - - ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1 - - - - Configure auditd admin_space_left Action on Low Disk Space - - ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1 - - - - Configure auditd flush priority - - ocil:ssg-auditd_data_retention_flush_action:testaction:1 - - - - Configure auditd Max Log File Size - - ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1 - - - - Configure auditd max_log_file_action Upon Reaching Maximum Log Size - - ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1 - - - - Configure auditd max_log_file_action Upon Reaching Maximum Log Size - - ocil:ssg-auditd_data_retention_max_log_file_action_stig_action:testaction:1 - - - - Configure auditd Number of Logs Retained - - ocil:ssg-auditd_data_retention_num_logs_action:testaction:1 - - - - Configure auditd space_left on Low Disk Space - - ocil:ssg-auditd_data_retention_space_left_action:testaction:1 - - - - Configure auditd space_left Action on Low Disk Space - - ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1 - - - - Set number of records to cause an explicit flush to audit logs - - ocil:ssg-auditd_freq_action:testaction:1 - - - - Include Local Events in Audit Logs - - ocil:ssg-auditd_local_events_action:testaction:1 - - - - Resolve information before writing to audit logs - - ocil:ssg-auditd_log_format_action:testaction:1 - - - - Set hostname as computer node name in audit logs - - ocil:ssg-auditd_name_format_action:testaction:1 - - - - Appropriate Action Must be Setup When the Internal Audit Event Queue is Full - - ocil:ssg-auditd_overflow_action_action:testaction:1 - - - - Write Audit Logs to the Disk - - ocil:ssg-auditd_write_logs_action:testaction:1 - - - - Configure auditing of unsuccessful file accesses - - ocil:ssg-audit_access_failed_action:testaction:1 - - - - Configure auditing of successful file accesses - - ocil:ssg-audit_access_success_action:testaction:1 - - - - Configure basic parameters of Audit system - - ocil:ssg-audit_basic_configuration_action:testaction:1 - - - - Configure auditing of unsuccessful file creations - - ocil:ssg-audit_create_failed_action:testaction:1 - - - - Configure auditing of successful file creations - - ocil:ssg-audit_create_success_action:testaction:1 - - - - Configure auditing of unsuccessful file deletions - - ocil:ssg-audit_delete_failed_action:testaction:1 - - - - Configure auditing of successful file deletions - - ocil:ssg-audit_delete_success_action:testaction:1 - - - - Configure immutable Audit login UIDs - - ocil:ssg-audit_immutable_login_uids_action:testaction:1 - - - - Configure auditing of unsuccessful file modifications - - ocil:ssg-audit_modify_failed_action:testaction:1 - - - - Configure auditing of successful file modifications - - ocil:ssg-audit_modify_success_action:testaction:1 - - - - Configure auditing of loading and unloading of kernel modules - - ocil:ssg-audit_module_load_action:testaction:1 - - - - Perform general configuration of Audit for OSPP - - ocil:ssg-audit_ospp_general_action:testaction:1 - - - - Configure auditing of unsuccessful ownership changes - - ocil:ssg-audit_owner_change_failed_action:testaction:1 - - - - Configure auditing of successful ownership changes - - ocil:ssg-audit_owner_change_success_action:testaction:1 - - - - Configure auditing of unsuccessful permission changes - - ocil:ssg-audit_perm_change_failed_action:testaction:1 - - - - Configure auditing of successful permission changes - - ocil:ssg-audit_perm_change_success_action:testaction:1 - - - - Configure audit according to OSPP requirements - - ocil:ssg-audit_rules_for_ospp_action:testaction:1 - - - - Extend Audit Backlog Limit for the Audit Daemon - - ocil:ssg-coreos_audit_backlog_limit_kernel_argument_action:testaction:1 - - - - Enable Auditing for Processes Which Start Prior to the Audit Daemon - - ocil:ssg-coreos_audit_option_action:testaction:1 - - - - Install audispd-plugins Package - - ocil:ssg-package_audispd-plugins_installed_action:testaction:1 - - - - Ensure the default plugins for the audit dispatcher are Installed - - ocil:ssg-package_audit-audispd-plugins_installed_action:testaction:1 - - - - Ensure the audit Subsystem is Installed - - ocil:ssg-package_audit_installed_action:testaction:1 - - - - Enable auditd Service - - ocil:ssg-service_auditd_enabled_action:testaction:1 - - - - Set the UEFI Boot Loader Admin Username to a Non-Default Value - - ocil:ssg-grub2_uefi_admin_username_action:testaction:1 - - - - Set the UEFI Boot Loader Password - - ocil:ssg-grub2_uefi_password_action:testaction:1 - - - - Enable Kernel Page-Table Isolation (KPTI) - - ocil:ssg-coreos_pti_kernel_argument_action:testaction:1 - - - - Disable vsyscalls - - ocil:ssg-coreos_vsyscall_kernel_argument_action:testaction:1 - - - - Disable Recovery Booting - - ocil:ssg-grub2_disable_recovery_action:testaction:1 - - - - IOMMU configuration directive - - ocil:ssg-grub2_enable_iommu_force_action:testaction:1 - - - - Configure L1 Terminal Fault mitigations - - ocil:ssg-grub2_l1tf_argument_action:testaction:1 - - - - Force kernel panic on uncorrected MCEs - - ocil:ssg-grub2_mce_argument_action:testaction:1 - - - - Ensure SMAP is not disabled during boot - - ocil:ssg-grub2_nosmap_argument_absent_action:testaction:1 - - - - Ensure SMEP is not disabled during boot - - ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1 - - - - Configure the confidence in TPM for entropy - - ocil:ssg-grub2_rng_core_default_quality_argument_action:testaction:1 - - - - Disable merging of slabs with similar size - - ocil:ssg-grub2_slab_nomerge_argument_action:testaction:1 - - - - Configure Speculative Store Bypass Mitigation - - ocil:ssg-grub2_spec_store_bypass_disable_argument_action:testaction:1 - - - - Enforce Spectre v2 mitigation - - ocil:ssg-grub2_spectre_v2_argument_action:testaction:1 - - - - Ensure debug-shell service is not enabled during boot - - ocil:ssg-grub2_systemd_debug-shell_argument_absent_action:testaction:1 - - - - Enable Auditing to Start Prior to the Audit Daemon in zIPL - - ocil:ssg-zipl_audit_argument_action:testaction:1 - - - - Extend Audit Backlog Limit for the Audit Daemon in zIPL - - ocil:ssg-zipl_audit_backlog_limit_argument_action:testaction:1 - - - - Ensure all zIPL boot entries are BLS compliant - - ocil:ssg-zipl_bls_entries_only_action:testaction:1 - - - - Ensure zIPL bootmap is up to date - - ocil:ssg-zipl_bootmap_is_up_to_date_action:testaction:1 - - - - Ensure SELinux Not Disabled in zIPL - - ocil:ssg-zipl_enable_selinux_action:testaction:1 - - - - Enable page allocator poisoning in zIPL - - ocil:ssg-zipl_page_poison_argument_action:testaction:1 - - - - Enable SLUB/SLAB allocator poisoning in zIPL - - ocil:ssg-zipl_slub_debug_argument_action:testaction:1 - - - - Ensure debug-shell service is not enabled in zIPL - - ocil:ssg-zipl_systemd_debug-shell_argument_absent_action:testaction:1 - - - - Disable vsyscalls in zIPL - - ocil:ssg-zipl_vsyscall_argument_action:testaction:1 - - - - Do not allow ACPI methods to be inserted/replaced at run time - - ocil:ssg-kernel_config_acpi_custom_method_action:testaction:1 - - - - Disable kernel support for MISC binaries - - ocil:ssg-kernel_config_binfmt_misc_action:testaction:1 - - - - Enable support for BUG() - - ocil:ssg-kernel_config_bug_action:testaction:1 - - - - Disable compatibility with brk() - - ocil:ssg-kernel_config_compat_brk_action:testaction:1 - - - - Disable the 32-bit vDSO - - ocil:ssg-kernel_config_compat_vdso_action:testaction:1 - - - - Enable checks on credential management - - ocil:ssg-kernel_config_debug_credentials_action:testaction:1 - - - - Disable kernel debugfs - - ocil:ssg-kernel_config_debug_fs_action:testaction:1 - - - - Enable checks on linked list manipulation - - ocil:ssg-kernel_config_debug_list_action:testaction:1 - - - - Enable checks on notifier call chains - - ocil:ssg-kernel_config_debug_notifiers_action:testaction:1 - - - - Enable checks on scatter-gather (SG) table operations - - ocil:ssg-kernel_config_debug_sg_action:testaction:1 - - - - Configure low address space to protect from user allocation - - ocil:ssg-kernel_config_default_mmap_min_addr_action:testaction:1 - - - - Disable /dev/kmem virtual device support - - ocil:ssg-kernel_config_devkmem_action:testaction:1 - - - - Disable hibernation - - ocil:ssg-kernel_config_hibernation_action:testaction:1 - - - - Disable IA32 emulation - - ocil:ssg-kernel_config_ia32_emulation_action:testaction:1 - - - - Disable the IPv6 protocol - - ocil:ssg-kernel_config_ipv6_action:testaction:1 - - - - Disable kexec system call - - ocil:ssg-kernel_config_kexec_action:testaction:1 - - - - Disable legacy (BSD) PTY support - - ocil:ssg-kernel_config_legacy_ptys_action:testaction:1 - - - - Enable module signature verification - - ocil:ssg-kernel_config_module_sig_action:testaction:1 - - - - Enable automatic signing of all modules - - ocil:ssg-kernel_config_module_sig_all_action:testaction:1 - - - - Require modules to be validly signed - - ocil:ssg-kernel_config_module_sig_force_action:testaction:1 - - - - Specify the hash to use when signing modules - - ocil:ssg-kernel_config_module_sig_hash_action:testaction:1 - - - - Specify module signing key to use - - ocil:ssg-kernel_config_module_sig_key_action:testaction:1 - - - - Sign kernel modules with SHA-512 - - ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1 - - - - Enable poison without sanity check - - ocil:ssg-kernel_config_page_poisoning_no_sanity_action:testaction:1 - - - - Use zero for poisoning instead of debugging value - - ocil:ssg-kernel_config_page_poisoning_zero_action:testaction:1 - - - - Remove the kernel mapping in user mode - - ocil:ssg-kernel_config_page_table_isolation_action:testaction:1 - - - - Kernel panic oops - - ocil:ssg-kernel_config_panic_on_oops_action:testaction:1 - - - - Kernel panic timeout - - ocil:ssg-kernel_config_panic_timeout_action:testaction:1 - - - - Disable support for /proc/kkcore - - ocil:ssg-kernel_config_proc_kcore_action:testaction:1 - - - - Randomize the address of the kernel image (KASLR) - - ocil:ssg-kernel_config_randomize_base_action:testaction:1 - - - - Randomize the kernel memory sections - - ocil:ssg-kernel_config_randomize_memory_action:testaction:1 - - - - Avoid speculative indirect branches in kernel - - ocil:ssg-kernel_config_retpoline_action:testaction:1 - - - - Enable seccomp to safely compute untrusted bytecode - - ocil:ssg-kernel_config_seccomp_action:testaction:1 - - - - Enable use of Berkeley Packet Filter with seccomp - - ocil:ssg-kernel_config_seccomp_filter_action:testaction:1 - - - - Enable different security models - - ocil:ssg-kernel_config_security_action:testaction:1 - - - - Restrict unprivileged access to the kernel syslog - - ocil:ssg-kernel_config_security_dmesg_restrict_action:testaction:1 - - - - Disable mutable hooks - - ocil:ssg-kernel_config_security_writable_hooks_action:testaction:1 - - - - Enable Yama support - - ocil:ssg-kernel_config_security_yama_action:testaction:1 - - - - Enable SLUB debugging support - - ocil:ssg-kernel_config_slub_debug_action:testaction:1 - - - - Enable TCP/IP syncookie support - - ocil:ssg-kernel_config_syn_cookies_action:testaction:1 - - - - Unmap kernel when running in userspace (aka KAISER) - - ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1 - - - - Disable x86 vsyscall emulation - - ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1 - - - - Ensure Rsyslog Authenticates Off-Loaded Audit Records - - ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1 - - - - Ensure Rsyslog Encrypts Off-Loaded Audit Records - - ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_action:testaction:1 - - - - Ensure Rsyslog Encrypts Off-Loaded Audit Records - - ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_action:testaction:1 - - - - Ensure Log Files Are Owned By Appropriate Group - - ocil:ssg-rsyslog_files_groupownership_action:testaction:1 - - - - Ensure Log Files Are Owned By Appropriate User - - ocil:ssg-rsyslog_files_ownership_action:testaction:1 - - - - Ensure System Log Files Have Correct Permissions - - ocil:ssg-rsyslog_files_permissions_action:testaction:1 - - - - Enable systemd-journald Service - - ocil:ssg-service_systemd-journald_enabled_action:testaction:1 - - - - Ensure Logrotate Runs Periodically - - ocil:ssg-ensure_logrotate_activated_action:testaction:1 - - - - Ensure syslog-ng is Installed - - ocil:ssg-package_syslogng_installed_action:testaction:1 - - - - Enable syslog-ng Service - - ocil:ssg-service_syslogng_enabled_action:testaction:1 - - - - Ensure Logs Sent To Remote Host - - ocil:ssg-rsyslog_remote_loghost_action:testaction:1 - - - - Ensure rsyslog is Installed - - ocil:ssg-package_rsyslog_installed_action:testaction:1 - - - - Enable rsyslog Service - - ocil:ssg-service_rsyslog_enabled_action:testaction:1 - - - - Install firewalld Package - - ocil:ssg-package_firewalld_installed_action:testaction:1 - - - - Verify firewalld Enabled - - ocil:ssg-service_firewalld_enabled_action:testaction:1 - - - - Install libreswan Package - - ocil:ssg-package_libreswan_installed_action:testaction:1 - - - - Verify ip6tables Enabled if Using IPv6 - - ocil:ssg-service_ip6tables_enabled_action:testaction:1 - - - - Verify iptables Enabled - - ocil:ssg-service_iptables_enabled_action:testaction:1 - - - - Set Default ip6tables Policy for Incoming Packets - - ocil:ssg-set_ip6tables_default_rule_action:testaction:1 - - - - Set Default iptables Policy for Incoming Packets - - ocil:ssg-set_iptables_default_rule_action:testaction:1 - - - - Set Default iptables Policy for Forwarded Packets - - ocil:ssg-set_iptables_default_rule_forward_action:testaction:1 - - - - Install iptables Package - - ocil:ssg-package_iptables_installed_action:testaction:1 - - - - Configure Accepting Router Advertisements on All IPv6 Interfaces - - ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_action:testaction:1 - - - - Disable Accepting ICMP Redirects for All IPv6 Interfaces - - ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1 - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces - - ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_action:testaction:1 - - - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default - - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces - - ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1 - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default - - ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_action:testaction:1 - - - - Ensure IPv6 is disabled through kernel boot parameter - - ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 - - - - Disable IPv6 Networking Support Automatic Loading - - ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1 - - - - Disable IPv6 Addressing on All IPv6 Interfaces - - ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1 - - - - Disable IPv6 Addressing on IPv6 Interfaces by Default - - ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_action:testaction:1 - - - - Disable Accepting Packets Routed Between Local Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1 - - - - Disable Accepting ICMP Redirects for All IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1 - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1 - - - - Configure ARP filtering for All IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1 - - - - Configure Response Mode of ARP Requests for All IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_action:testaction:1 - - - - Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1 - - - - Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_action:testaction:1 - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1 - - - - Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1 - - - - Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_action:testaction:1 - - - - Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1 - - - - Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default - - ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1 - - - - Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default - - ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1 - - - - Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default - - ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1 - - - - Configure Kernel Parameter for Accepting Secure Redirects By Default - - ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1 - - - - Configure Sending and Accepting Shared Media Redirects by Default - - ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1 - - - - Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1 - - - - Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1 - - - - Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments - - ocil:ssg-sysctl_net_ipv4_tcp_invalid_ratelimit_action:testaction:1 - - - - Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - - ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1 - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1 - - - - Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default - - ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1 - - - - Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - - ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1 - - - - Verify ufw Enabled - - ocil:ssg-service_ufw_enabled_action:testaction:1 - - - - Disable ATM Support - - ocil:ssg-kernel_module_atm_disabled_action:testaction:1 - - - - Disable CAN Support - - ocil:ssg-kernel_module_can_disabled_action:testaction:1 - - - - Disable IEEE 1394 (FireWire) Support - - ocil:ssg-kernel_module_firewire-core_disabled_action:testaction:1 - - - - Disable RDS Support - - ocil:ssg-kernel_module_rds_disabled_action:testaction:1 - - - - Disable SCTP Support - - ocil:ssg-kernel_module_sctp_disabled_action:testaction:1 - - - - Disable TIPC Support - - ocil:ssg-kernel_module_tipc_disabled_action:testaction:1 - - - - Disable Bluetooth Kernel Module - - ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1 - - - - Disable Kernel cfg80211 Module - - ocil:ssg-kernel_module_cfg80211_disabled_action:testaction:1 - - - - Disable Kernel iwlmvm Module - - ocil:ssg-kernel_module_iwlmvm_disabled_action:testaction:1 - - - - Disable Kernel iwlwifi Module - - ocil:ssg-kernel_module_iwlwifi_disabled_action:testaction:1 - - - - Disable Kernel mac80211 Module - - ocil:ssg-kernel_module_mac80211_disabled_action:testaction:1 - - - - Disable Bluetooth Service - - ocil:ssg-service_bluetooth_disabled_action:testaction:1 - - - - Deactivate Wireless Network Interfaces - - ocil:ssg-wireless_disable_interfaces_action:testaction:1 - - - - Prevent non-Privileged Users from Modifying Network Interfaces using nmcli - - ocil:ssg-network_nmcli_permissions_action:testaction:1 - - - - Verify Group Who Owns Backup group File - - ocil:ssg-file_groupowner_backup_etc_group_action:testaction:1 - - - - Verify Group Who Owns Backup gshadow File - - ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1 - - - - Verify Group Who Owns Backup passwd File - - ocil:ssg-file_groupowner_backup_etc_passwd_action:testaction:1 - - - - Verify User Who Owns Backup shadow File - - ocil:ssg-file_groupowner_backup_etc_shadow_action:testaction:1 - - - - Verify Group Who Owns group File - - ocil:ssg-file_groupowner_etc_group_action:testaction:1 - - - - Verify Group Who Owns gshadow File - - ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1 - - - - Verify Group Who Owns passwd File - - ocil:ssg-file_groupowner_etc_passwd_action:testaction:1 - - - - Verify Group Who Owns shadow File - - ocil:ssg-file_groupowner_etc_shadow_action:testaction:1 - - - - Verify User Who Owns Backup group File - - ocil:ssg-file_owner_backup_etc_group_action:testaction:1 - - - - Verify User Who Owns Backup gshadow File - - ocil:ssg-file_owner_backup_etc_gshadow_action:testaction:1 - - - - Verify User Who Owns Backup passwd File - - ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1 - - - - Verify Group Who Owns Backup shadow File - - ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1 - - - - Verify User Who Owns group File - - ocil:ssg-file_owner_etc_group_action:testaction:1 - - - - Verify User Who Owns gshadow File - - ocil:ssg-file_owner_etc_gshadow_action:testaction:1 - - - - Verify User Who Owns passwd File - - ocil:ssg-file_owner_etc_passwd_action:testaction:1 - - - - Verify User Who Owns shadow File - - ocil:ssg-file_owner_etc_shadow_action:testaction:1 - - - - Verify Permissions on Backup group File - - ocil:ssg-file_permissions_backup_etc_group_action:testaction:1 - - - - Verify Permissions on Backup gshadow File - - ocil:ssg-file_permissions_backup_etc_gshadow_action:testaction:1 - - - - Verify Permissions on Backup passwd File - - ocil:ssg-file_permissions_backup_etc_passwd_action:testaction:1 - - - - Verify Permissions on Backup shadow File - - ocil:ssg-file_permissions_backup_etc_shadow_action:testaction:1 - - - - Verify Permissions on group File - - ocil:ssg-file_permissions_etc_group_action:testaction:1 - - - - Verify Permissions on gshadow File - - ocil:ssg-file_permissions_etc_gshadow_action:testaction:1 - - - - Verify Permissions on passwd File - - ocil:ssg-file_permissions_etc_passwd_action:testaction:1 - - - - Verify Permissions on shadow File - - ocil:ssg-file_permissions_etc_shadow_action:testaction:1 - - - - Verify Group Who Owns /var/log Directory - - ocil:ssg-file_groupowner_var_log_action:testaction:1 - - - - Verify Group Who Owns /var/log/messages File - - ocil:ssg-file_groupowner_var_log_messages_action:testaction:1 - - - - Verify Group Who Owns /var/log/syslog File - - ocil:ssg-file_groupowner_var_log_syslog_action:testaction:1 - - - - Verify User Who Owns /var/log Directory - - ocil:ssg-file_owner_var_log_action:testaction:1 - - - - Verify User Who Owns /var/log/messages File - - ocil:ssg-file_owner_var_log_messages_action:testaction:1 - - - - Verify User Who Owns /var/log/syslog File - - ocil:ssg-file_owner_var_log_syslog_action:testaction:1 - - - - Verify Permissions on /var/log Directory - - ocil:ssg-file_permissions_var_log_action:testaction:1 - - - - Verify Permissions on /var/log/messages File - - ocil:ssg-file_permissions_var_log_messages_action:testaction:1 - - - - Verify Permissions on /var/log/syslog File - - ocil:ssg-file_permissions_var_log_syslog_action:testaction:1 - - - - Verify that System Executable Have Root Ownership - - ocil:ssg-dir_ownership_binary_dirs_action:testaction:1 - - - - Verify that Shared Library Directories Have Root Ownership - - ocil:ssg-dir_ownership_library_dirs_action:testaction:1 - - - - Verify that System Executable Directories Have Restrictive Permissions - - ocil:ssg-dir_permissions_binary_dirs_action:testaction:1 - - - - Verify that Shared Library Directories Have Restrictive Permissions - - ocil:ssg-dir_permissions_library_dirs_action:testaction:1 - - - - Verify that System Executables Have Root Ownership - - ocil:ssg-file_ownership_binary_dirs_action:testaction:1 - - - - Verify that Shared Library Files Have Root Ownership - - ocil:ssg-file_ownership_library_dirs_action:testaction:1 - - - - Verify that System Executables Have Restrictive Permissions - - ocil:ssg-file_permissions_binary_dirs_action:testaction:1 - - - - Verify that Shared Library Files Have Restrictive Permissions - - ocil:ssg-file_permissions_library_dirs_action:testaction:1 - - - - Verify that All World-Writable Directories Have Sticky Bits Set - - ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1 - - - - Verify that local System.map file (if exists) is readable only by root - - ocil:ssg-file_permissions_systemmap_action:testaction:1 - - - - Ensure No World-Writable Files Exist - - ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1 - - - - Enable Kernel Parameter to Enforce DAC on Hardlinks - - ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1 - - - - Enable Kernel Parameter to Enforce DAC on Symlinks - - ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1 - - - - Disable Mounting of cramfs - - ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1 - - - - Disable Modprobe Loading of USB Storage Driver - - ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1 - - - - Disable the Automounter - - ocil:ssg-service_autofs_disabled_action:testaction:1 - - - - Add nodev Option to /boot - - ocil:ssg-mount_option_boot_nodev_action:testaction:1 - - - - Add nosuid Option to /boot - - ocil:ssg-mount_option_boot_nosuid_action:testaction:1 - - - - Add nodev Option to /dev/shm - - ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1 - - - - Add noexec Option to /dev/shm - - ocil:ssg-mount_option_dev_shm_noexec_action:testaction:1 - - - - Add nosuid Option to /dev/shm - - ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1 - - - - Add nodev Option to /home - - ocil:ssg-mount_option_home_nodev_action:testaction:1 - - - - Add nosuid Option to /home - - ocil:ssg-mount_option_home_nosuid_action:testaction:1 - - - - Add nodev Option to Non-Root Local Partitions - - ocil:ssg-mount_option_nodev_nonroot_local_partitions_action:testaction:1 - - - - Add nodev Option to Removable Media Partitions - - ocil:ssg-mount_option_nodev_removable_partitions_action:testaction:1 - - - - Add noexec Option to Removable Media Partitions - - ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1 - - - - Add nosuid Option to Removable Media Partitions - - ocil:ssg-mount_option_nosuid_removable_partitions_action:testaction:1 - - - - Add nodev Option to /tmp - - ocil:ssg-mount_option_tmp_nodev_action:testaction:1 - - - - Add noexec Option to /tmp - - ocil:ssg-mount_option_tmp_noexec_action:testaction:1 - - - - Add nosuid Option to /tmp - - ocil:ssg-mount_option_tmp_nosuid_action:testaction:1 - - - - Add nodev Option to /var/log/audit - - ocil:ssg-mount_option_var_log_audit_nodev_action:testaction:1 - - - - Add noexec Option to /var/log/audit - - ocil:ssg-mount_option_var_log_audit_noexec_action:testaction:1 - - - - Add nosuid Option to /var/log/audit - - ocil:ssg-mount_option_var_log_audit_nosuid_action:testaction:1 - - - - Add nodev Option to /var/log - - ocil:ssg-mount_option_var_log_nodev_action:testaction:1 - - - - Add noexec Option to /var/log - - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 - - - - Add nosuid Option to /var/log - - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 - - - - Add nodev Option to /var - - ocil:ssg-mount_option_var_nodev_action:testaction:1 - - - - Add nosuid Option to /var - - ocil:ssg-mount_option_var_nosuid_action:testaction:1 - - - - Add nodev Option to /var/tmp - - ocil:ssg-mount_option_var_tmp_nodev_action:testaction:1 - - - - Add noexec Option to /var/tmp - - ocil:ssg-mount_option_var_tmp_noexec_action:testaction:1 - - - - Add nosuid Option to /var/tmp - - ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1 - - - - Disable core dump backtraces - - ocil:ssg-coredump_disable_backtraces_action:testaction:1 - - - - Disable storing core dump - - ocil:ssg-coredump_disable_storage_action:testaction:1 - - - - Disable Core Dumps for All Users - - ocil:ssg-disable_users_coredumps_action:testaction:1 - - - - Disable acquiring, saving, and processing core dumps - - ocil:ssg-service_systemd-coredump_disabled_action:testaction:1 - - - - Disable Core Dumps for SUID programs - - ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1 - - - - Restrict Exposed Kernel Pointer Addresses Access - - ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1 - - - - Enable Randomized Layout of Virtual Address Space - - ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1 - - - - Enable page allocator poisoning - - ocil:ssg-coreos_page_poison_kernel_argument_action:testaction:1 - - - - Enable SLUB/SLAB allocator poisoning - - ocil:ssg-coreos_slub_debug_kernel_argument_action:testaction:1 - - - - Disable the uvcvideo module - - ocil:ssg-kernel_module_uvcvideo_disabled_action:testaction:1 - - - - Disable storing core dumps - - ocil:ssg-sysctl_kernel_core_pattern_action:testaction:1 - - - - Disable storing core dumps - - ocil:ssg-sysctl_kernel_core_pattern_empty_string_action:testaction:1 - - - - Configure file name of core dumps - - ocil:ssg-sysctl_kernel_core_uses_pid_action:testaction:1 - - - - Restrict Access to Kernel Message Buffer - - ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1 - - - - Disable Kernel Image Loading - - ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1 - - - - Kernel panic on oops - - ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1 - - - - Disallow kernel profiling by unprivileged users - - ocil:ssg-sysctl_kernel_perf_event_paranoid_action:testaction:1 - - - - Disable Access to Network bpf() Syscall From Unprivileged Processes - - ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_action:testaction:1 - - - - Restrict usage of ptrace to descendant processes - - ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1 - - - - Harden the operation of the BPF just-in-time compiler - - ocil:ssg-sysctl_net_core_bpf_jit_harden_action:testaction:1 - - - - Disable the use of user namespaces - - ocil:ssg-sysctl_user_max_user_namespaces_action:testaction:1 - - - - Ensure SELinux Not Disabled in the kernel arguments - - ocil:ssg-coreos_enable_selinux_kernel_argument_action:testaction:1 - - - - Ensure SELinux Not Disabled in /etc/default/grub - - ocil:ssg-grub2_enable_selinux_action:testaction:1 - - - - Install libselinux Package - - ocil:ssg-package_libselinux_installed_action:testaction:1 - - - - Uninstall setroubleshoot-plugins Package - - ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1 - - - - Uninstall setroubleshoot-server Package - - ocil:ssg-package_setroubleshoot-server_removed_action:testaction:1 - - - - Ensure No Daemons are Unconfined by SELinux - - ocil:ssg-selinux_confinement_of_daemons_action:testaction:1 - - - - Configure SELinux Policy - - ocil:ssg-selinux_policytype_action:testaction:1 - - - - Ensure SELinux State is Enforcing - - ocil:ssg-selinux_state_action:testaction:1 - - - - Encrypt Partitions - - ocil:ssg-encrypt_partitions_action:testaction:1 - - - - Ensure /home Located On Separate Partition - - ocil:ssg-partition_for_home_action:testaction:1 - - - - Ensure /srv Located On Separate Partition - - ocil:ssg-partition_for_srv_action:testaction:1 - - - - Ensure /tmp Located On Separate Partition - - ocil:ssg-partition_for_tmp_action:testaction:1 - - - - Ensure /var Located On Separate Partition - - ocil:ssg-partition_for_var_action:testaction:1 - - - - Ensure /var/log Located On Separate Partition - - ocil:ssg-partition_for_var_log_action:testaction:1 - - - - Ensure /var/log/audit Located On Separate Partition - - ocil:ssg-partition_for_var_log_audit_action:testaction:1 - - - - Ensure /var/tmp Located On Separate Partition - - ocil:ssg-partition_for_var_tmp_action:testaction:1 - - - - Disable XDMCP in GDM - - ocil:ssg-gnome_gdm_disable_xdmcp_action:testaction:1 - - - - The Installed Operating System Is FIPS 140-2 Certified - - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 - - - - Configure BIND to use System Crypto Policy - - ocil:ssg-configure_bind_crypto_policy_action:testaction:1 - - - - Configure System Cryptography Policy - - ocil:ssg-configure_crypto_policy_action:testaction:1 - - - - Configure Kerberos to use System Crypto Policy - - ocil:ssg-configure_kerberos_crypto_policy_action:testaction:1 - - - - Configure Libreswan to use System Crypto Policy - - ocil:ssg-configure_libreswan_crypto_policy_action:testaction:1 - - - - Configure OpenSSL library to use System Crypto Policy - - ocil:ssg-configure_openssl_crypto_policy_action:testaction:1 - - - - Configure SSH to use System Crypto Policy - - ocil:ssg-configure_ssh_crypto_policy_action:testaction:1 - - - - Harden OpenSSL Crypto Policy - - ocil:ssg-harden_openssl_crypto_policy_action:testaction:1 - - - - Harden SSH client Crypto Policy - - ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1 - - - - Harden SSHD Crypto Policy - - ocil:ssg-harden_sshd_crypto_policy_action:testaction:1 - - - - Install the Host Intrusion Prevention System (HIPS) Module - - ocil:ssg-package_MFEhiplsm_installed_action:testaction:1 - - - - Configure Backups of User Data - - ocil:ssg-configure_user_data_backups_action:testaction:1 - - - - Enable Dracut FIPS Module - - ocil:ssg-enable_dracut_fips_module_action:testaction:1 - - - - Enable FIPS Mode - - ocil:ssg-enable_fips_mode_action:testaction:1 - - - - Ensure '/etc/system-fips' exists - - ocil:ssg-etc_system_fips_exists_action:testaction:1 - - - - Enable FIPS Mode in GRUB2 - - ocil:ssg-grub2_enable_fips_mode_action:testaction:1 - - - - Install the dracut-fips-aesni Package - - ocil:ssg-package_dracut-fips-aesni_installed_action:testaction:1 - - - - Install the dracut-fips Package - - ocil:ssg-package_dracut-fips_installed_action:testaction:1 - - - - Set kernel parameter 'crypto.fips_enabled' to 1 - - ocil:ssg-sysctl_crypto_fips_enabled_action:testaction:1 - - - - Build and Test AIDE Database - - ocil:ssg-aide_build_database_action:testaction:1 - - - - Install AIDE - - ocil:ssg-package_aide_installed_action:testaction:1 - - - - Verify and Correct Ownership with RPM - - ocil:ssg-rpm_verify_ownership_action:testaction:1 - - - - Verify and Correct File Permissions with RPM - - ocil:ssg-rpm_verify_permissions_action:testaction:1 - - - - Install sudo Package - - ocil:ssg-package_sudo_installed_action:testaction:1 - - - - Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC - - ocil:ssg-sudo_add_noexec_action:testaction:1 - - - - Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty - - ocil:ssg-sudo_add_requiretty_action:testaction:1 - - - - Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty - - ocil:ssg-sudo_add_use_pty_action:testaction:1 - - - - Ensure Sudo Logfile Exists - sudo logfile - - ocil:ssg-sudo_custom_logfile_action:testaction:1 - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate - - ocil:ssg-sudo_remove_no_authenticate_action:testaction:1 - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD - - ocil:ssg-sudo_remove_nopasswd_action:testaction:1 - - - - Ensure Users Re-Authenticate for Privilege Escalation - sudo - - ocil:ssg-sudo_require_authentication_action:testaction:1 - - - - Only the VDSM User Can Use sudo NOPASSWD - - ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1 - - - - Explicit arguments in sudo specifications - - ocil:ssg-sudoers_explicit_command_args_action:testaction:1 - - - - Don't define allowed commands in sudoers by means of exclusion - - ocil:ssg-sudoers_no_command_negation_action:testaction:1 - - - - Don't target root user in the sudoers file - - ocil:ssg-sudoers_no_root_target_action:testaction:1 - - - - Ensure gnutls-utils is installed - - ocil:ssg-package_gnutls-utils_installed_action:testaction:1 - - - - Ensure nss-tools is installed - - ocil:ssg-package_nss-tools_installed_action:testaction:1 - - - - Ensure Red Hat GPG Key Installed - - ocil:ssg-ensure_redhat_gpgkey_installed_action:testaction:1 - - - - Prefer to use a 64-bit Operating System when supported - - ocil:ssg-prefer_64bit_os_action:testaction:1 - - - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - PASS - - - FAIL - - - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -cron service: -$ sudo systemctl is-active cron -If the service is running, it should return the following: active - Is it the case that ? - - - - Run the following command to determine if the bind package is installed: -$ rpm -q bind - Is it the case that the package is installed? - - - - Verify that fapolicyd on Red Hat Enterprise Linux CoreOS 4 prevents ability of non-privileged users to grant other users direct access to the contents of their home directories/folders. -Run the following command: - -grep -r "deny_audit perm=chmod path=/home" /etc/fapolicyd/rules.d - Is it the case that fapolicyd allows non-privileged users to grant other users direct access to the contents of their home directories/folders? - - - - Run the following command to determine if the fapolicyd package is installed: $ rpm -q fapolicyd - Is it the case that the package is not installed? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -fapolicyd service: -$ sudo systemctl is-active fapolicyd -If the service is running, it should return the following: active - Is it the case that the service is not enabled? - - - - Run the following command to see if there are some keytabs -that would potentially allow the use of Kerberos by system daemons. -$ ls -la /etc/*.keytab -The expected result is -ls: cannot access '/etc/*.keytab': No such file or directory - Is it the case that a keytab file is present on the system? - - - - Run the following command to determine if the openldap-clients package is installed: -$ rpm -q openldap-clients - Is it the case that the package is installed? - - - - Find the list of alias maps used by the Postfix mail server: -$ sudo postconf alias_maps -Query the Postfix alias maps for an alias for the root user: -$ sudo postmap -q root hash:/etc/aliases -The output should return an alias. - Is it the case that the alias is not set? - - - - Find the list of alias maps used by the Postfix mail server: -$ sudo postconf alias_maps -Query the Postfix alias maps for an alias for the postmaster user: -$ sudo postmap -q postmaster hash:/etc/aliases -The output should return root. - Is it the case that the alias is not set or is not root? - - - - Run the following command to ensure postfix routes mail to this system: -$ grep relayhost /etc/postfix/main.cf -If properly configured, the output should show only . - Is it the case that it is not? - - - - Run the following command to determine if the postfix package is installed: $ rpm -q postfix - Is it the case that the package is not installed? - - - - Run the following command to determine if the sendmail package is installed: -$ rpm -q sendmail - Is it the case that the package is installed? - - - - To verify all squashing has been disabled, run the following command: -$ grep all_squash /etc/exports - Is it the case that there is output? - - - - To verify that port has been set properly, perform the following: -$ grep '\bport\b' /etc/chrony.conf -The output should return -port 0 - Is it the case that port is not set or port is set to a non-zero value? - - - - To verify that cmdport has been set properly, perform the following: -$ grep '\bcmdport\b' /etc/chrony.conf -The output should return -cmdport 0 - Is it the case that cmdport is not set or cmdport is set to a non-zero value? - - - - Verify Red Hat Enterprise Linux CoreOS 4 is securely comparing internal information system clocks at a regular interval with an NTP server with the following commands: - -To verify that maxpoll has been set properly, perform the following: -$ sudo grep maxpoll /etc/ntp.conf /etc/chrony.conf -The output should return: -maxpoll . - Is it the case that maxpoll does not exist or maxpoll has not been set to the expected value of <sub idref="var_time_service_set_maxpoll" />? - - - - To verify that a remote NTP service is configured for time synchronization, -open the following file: - -/etc/chrony.conf in the case the system in question is -configured to use the chronyd as the NTP daemon (default setting) -/etc/ntp.conf in the case the system in question is configured -to use the ntpd as the NTP daemon - -In the file, there should be a section similar to the following: -server ntpserver - Is it the case that this is not the case? - - - - Run the following command and verify that time sources are only configure with server directive: -# grep -E "^(server|pool)" /etc/chrony.conf -A line with the appropriate server should be returned, any line returned starting with pool is a finding. - Is it the case that an authoritative remote time server is not configured or configured with pool directive? - - - - Run the following command and verify remote server is configured properly: -# grep -E "^(server|pool)" /etc/chrony.conf - Is it the case that a remote time server is not configured? - - - - To verify that a remote NTP service is configured for time synchronization, -open the following file: -/etc/ntp.conf -In the file, there should be a section similar to the following: -server ntpserver - Is it the case that this is not the case? - - - - Run the following command to determine if the chrony package is installed: $ rpm -q chrony - Is it the case that the package is not installed? - - - - Run the following command to determine if the ntp package is installed: $ rpm -q ntp - Is it the case that the package is not installed? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -chronyd service: -$ sudo systemctl is-active chronyd -If the service is running, it should return the following: active - Is it the case that the chronyd process is not running? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -chronyd service: -$ sudo systemctl is-active chronyd -If the service is running, it should return the following: active - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -ntpd service: -$ sudo systemctl is-active ntpd -If the service is running, it should return the following: active - Is it the case that ? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -ntp service: -$ sudo systemctl is-active ntp -If the service is running, it should return the following: active - Is it the case that ? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -ntpd service: -$ sudo systemctl is-active ntpd -If the service is running, it should return the following: active - Is it the case that ? - - - - The existence of the file /etc/hosts.equiv or a file named -.rhosts inside a user home directory indicates the presence -of an Rsh trust relationship. - Is it the case that these files exist? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -rngd service: -$ sudo systemctl is-active rngd -If the service is running, it should return the following: active - Is it the case that the "rngd" service is disabled, masked, or not started.? - - - - Run the following command to determine if the samba-common package is installed: $ rpm -q samba-common - Is it the case that the package is not installed? - - - - Run the following command to determine if the net-snmp package is installed: -$ rpm -q net-snmp - Is it the case that the package is installed? - - - - To check if RekeyLimit is set correctly, run the following command: -$ sudo grep RekeyLimit /etc/ssh/ssh_config.d/*.conf -If configured properly, output should be -/etc/ssh/ssh_config.d/02-rekey-limit.conf: -RekeyLimit -Check also the main configuration file with the following command: -$ sudo grep RekeyLimit /etc/ssh/ssh_config -The command should not return any output. - Is it the case that it is commented out or is not set? - - - - To determine how the SSH daemon's HostbasedAuthentication option is set, run the following command: - -$ sudo grep -i HostbasedAuthentication /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To check which SSH protocol version is allowed, check version of openssh-server with following command: - -$ rpm -qi openssh-server | grep Version - -Versions equal to or higher than 7.4 only allow Protocol 2. -If version is lower than 7.4, run the following command to check configuration: -$ sudo grep Protocol /etc/ssh/sshd_config -If configured properly, output should be Protocol 2 - Is it the case that it is commented out or is not set correctly to Protocol 2? - - - - To check if compression is enabled or set correctly, run the -following command: -$ sudo grep Compression /etc/ssh/sshd_config -If configured properly, output should be no or delayed. - Is it the case that it is commented out, or is not set to no or delayed? - - - - To determine how the SSH daemon's PermitEmptyPasswords option is set, run the following command: - -$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's GSSAPIAuthentication option is set, run the following command: - -$ sudo grep -i GSSAPIAuthentication /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's KerberosAuthentication option is set, run the following command: - -$ sudo grep -i KerberosAuthentication /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's PubkeyAuthentication option is set, run the following command: - -$ sudo grep -i PubkeyAuthentication /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's IgnoreRhosts option is set, run the following command: - -$ sudo grep -i IgnoreRhosts /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To check which SSH protocol version is allowed, check version of -openssh-server with following command: -$ rpm -qi openssh-server | grep Version -Versions equal to or higher than 7.4 have deprecated the RhostsRSAAuthentication option. -If version is lower than 7.4, run the following command to check configuration: -To determine how the SSH daemon's RhostsRSAAuthentication option is set, run the following command: - -$ sudo grep -i RhostsRSAAuthentication /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's PermitRootLogin option is set, run the following command: - -$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's PermitRootLogin option is set, run the following command: - -$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config - -If a line indicating prohibit-password is returned, then the required value is set. - Is it the case that it is commented out or not configured properly? - - - - To determine how the SSH daemon's AllowTcpForwarding option is set, run the following command: - -$ sudo grep -i AllowTcpForwarding /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - Is it the case that The AllowTcpForwarding option exists and is disabled? - - - - To determine how the SSH daemon's IgnoreUserKnownHosts option is set, run the following command: - -$ sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's X11Forwarding option is set, run the following command: - -$ sudo grep -i X11Forwarding /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's PermitUserEnvironment option is set, run the following command: - -$ sudo grep -i PermitUserEnvironment /etc/ssh/sshd_config - -If a line indicating no is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's GSSAPIAuthentication option is set, run the following command: - -$ sudo grep -i GSSAPIAuthentication /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's UsePAM option is set, run the following command: - -$ sudo grep -i UsePAM /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's PubkeyAuthentication option is set, run the following command: - -$ sudo grep -i PubkeyAuthentication /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's StrictModes option is set, run the following command: - -$ sudo grep -i StrictModes /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's Banner option is set, run the following command: - -$ sudo grep -i Banner /etc/ssh/sshd_config - -If a line indicating /etc/issue is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's Banner option is set, run the following command: - -$ sudo grep -i Banner /etc/ssh/sshd_config - -If a line indicating /etc/issue.net is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's X11Forwarding option is set, run the following command: - -$ sudo grep -i X11Forwarding /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To ensure sshd limits the users who can log in, run the following: -$ sudo grep AllowUsers /etc/ssh/sshd_config -If properly configured, the output should be a list of usernames allowed to log in -to this system. - Is it the case that sshd does not limit the users who can log in? - - - - To determine how the SSH daemon's PrintLastLog option is set, run the following command: - -$ sudo grep -i PrintLastLog /etc/ssh/sshd_config - -If a line indicating yes is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To check if RekeyLimit is set correctly, run the -following command: - -$ sudo grep RekeyLimit /etc/ssh/sshd_config - -If configured properly, output should be -RekeyLimit - Is it the case that it is commented out or is not set? - - - - Run the following command to see what the timeout interval is: -$ sudo grep ClientAliveInterval /etc/ssh/sshd_config -If properly configured, the output should be: -ClientAliveInterval - Is it the case that it is commented out or not configured properly? - - - - To ensure ClientAliveInterval is set correctly, run the following command: -$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config -If properly configured, the output should be: -ClientAliveCountMax -For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes an idle timeout precisely when -the ClientAliveInterval is set. Starting with v8.2, a value of 0 disables the timeout -functionality completely. -If the option is set to a number greater than 0, then the idle session will be disconnected after -ClientAliveInterval * ClientAliveCountMax seconds. - Is it the case that it is commented out or not configured properly? - - - - To ensure ClientAliveInterval is set correctly, run the following command: - -$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config - -If properly configured, the output should be: -ClientAliveCountMax 0 - -In this case, the SSH idle timeout occurs precisely when -the ClientAliveInterval is set. - Is it the case that it is commented out or not configured properly? - - - - To ensure LoginGraceTime is set correctly, run the following command: -$ sudo grep LoginGraceTime /etc/ssh/sshd_config -If properly configured, the output should be: -LoginGraceTime -If the option is set to a number greater than 0, then the unauthenticated session will be disconnected -after the configured number seconds. - Is it the case that it is commented out or not configured properly? - - - - To determine how the SSH daemon's LogLevel option is set, run the following command: - -$ sudo grep -i LogLevel /etc/ssh/sshd_config - -If a line indicating INFO is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To determine how the SSH daemon's LogLevel option is set, run the following command: - -$ sudo grep -i LogLevel /etc/ssh/sshd_config - -If a line indicating VERBOSE is returned, then the required value is set. - - Is it the case that the required value is not set? - - - - To ensure the MaxAuthTries parameter is set, run the following command: -$ sudo grep MaxAuthTries /etc/ssh/sshd_config -If properly configured, output should be: -MaxAuthTries - Is it the case that it is commented out or not configured properly? - - - - Run the following command to see what the max sessions number is: -$ sudo grep MaxSessions /etc/ssh/sshd_config -If properly configured, the output should be: -MaxSessions - Is it the case that MaxSessions is not configured or not configured correctly? - - - - To check if MaxStartups is configured, run the following command: -$ sudo grep MaxStartups /etc/ssh/sshd_config -If configured, this command should output the configuration. - Is it the case that maxstartups is not configured? - - - - To check if UsePrivilegeSeparation is enabled or set correctly, run the -following command: -$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config -If configured properly, output should be . - Is it the case that it is commented out or is not enabled? - - - - To check the group ownership of /etc/ssh/sshd_config, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/ssh/sshd_config -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/ssh/sshd_config does not have a group owner of root? - - - - To check the ownership of /etc/ssh/sshd_config, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/ssh/sshd_config -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/ssh/sshd_config does not have an owner of root? - - - - To check the permissions of /etc/ssh/sshd_config, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/ssh/sshd_config -If properly configured, the output should indicate the following permissions: --rw------- - Is it the case that /etc/ssh/sshd_config does not have unix mode -rw-------? - - - - To check the permissions of /etc/ssh/*_key, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/ssh/*_key -If properly configured, the output should indicate the following permissions: --rw-r----- - Is it the case that /etc/ssh/*_key does not have unix mode -rw-r-----? - - - - To check the permissions of /etc/ssh/*.pub, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/ssh/*.pub -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /etc/ssh/*.pub does not have unix mode -rw-r--r--? - - - - Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server - Is it the case that the package is not installed? - - - - Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server - Is it the case that the package is installed? - - - - To verify that smart cards are enabled in SSSD, run the following command: -$ sudo grep pam_cert_auth /etc/sssd/sssd.conf -If configured properly, output should be -pam_cert_auth = True - Is it the case that smart cards are not enabled in SSSD? - - - - -To verify that SSSD expires offline credentials, run the following command: -$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf -If configured properly, output should be -offline_credentials_expiration = 1 - Is it the case that it does not exist or is not configured properly? - - - - To verify that SSSD is configured to run as user sssd, run the following command: -$ sudo grep -r '\buser\b' /etc/sssd -If configured properly, output should similar to /etc/sssd/conf.d/ospp.conf:user = sssd. -Sanity of SSSD configuration in general can be checked using $ sudo sssctl config-check - Is it the case that it does not exist or is not configured properly? - - - - To verify that Linux Audit logging is enabled for the USBGuard daemon, -run the following command: -$ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf -The output should be -AuditBackend=LinuxAudit - Is it the case that AuditBackend is not set to LinuxAudit? - - - - Run the following command to determine if the usbguard package is installed: $ rpm -q usbguard - Is it the case that the package is not installed? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -usbguard service: -$ sudo systemctl is-active usbguard -If the service is running, it should return the following: active - Is it the case that the service is not enabled? - - - - To verify that USB Human Interface Devices will be authorized by the USBGuard daemon, -run the following command: -$ sudo grep allow /etc/usbguard/rules.conf -The output lines should include -allow with-interface match-all { 03:*:* } - Is it the case that USB devices of class 3 are not authorized? - - - - To verify that USB Human Interface Devices and hubs will be authorized by the USBGuard daemon, -run the following command: -$ sudo grep allow /etc/usbguard/rules.conf -The output lines should include -allow with-interface match-all { 03:*:* 09:00:* } - Is it the case that USB devices of class 3 and 9:00 are not authorized? - - - - To verify that USB hubs will be authorized by the USBGuard daemon, -run the following command: -$ sudo grep allow /etc/usbguard/rules.conf -One of the output lines should be -allow with-interface match-all { 09:00:* } - Is it the case that USB devices of class 9 are not authorized? - - - - To check if the system login banner is compliant, -run the following command: -$ cat /etc/issue - Is it the case that it does not display the required banner? - - - - To check the group ownership of /etc/issue, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/issue -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/issue does not have a group owner of root? - - - - To check the ownership of /etc/issue, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/issue -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/issue does not have an owner of root? - - - - To check the permissions of /etc/issue, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/issue -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /etc/issue does not have unix mode -rw-r--r--? - - - - Verify the "/etc/security/faillock.conf" file is configured to log user name information when unsuccessful logon attempts occur: - -$ sudo grep audit /etc/security/faillock.conf - -audit - Is it the case that the "audit" option is not set, is missing or commented out? - - - - Verify the "/etc/security/faillock.conf" file is configured use a non-default faillock directory to ensure contents persist after reboot: - -$ sudo grep 'dir =' /etc/security/faillock.conf - -dir = /var/log/faillock - Is it the case that the "dir" option is not set to a non-default documented tally log directory, is missing or commented out? - - - - Verify the operating system is not configured to bypass password requirements for privilege -escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command: -$ sudo grep pam_succeed_if /etc/pam.d/sudo - Is it the case that system is configured to bypass password requirements for privilege escalation? - - - - Verify users are provided with feedback on when account accesses last occurred with the following command: - -$ grep pam_lastlog.so /etc/pam.d/postlogin - Is it the case that "pam_lastlog" is missing from "/etc/pam.d/postlogin" file, or the silent option is present? - - - - To verify that tmux is configured to execute, -run the following command: -$ grep -A1 -B3 "case ..name. in sshd|login) exec tmux ;; esac" /etc/bashrc /etc/profile.d/* -The output should return the following: -if [ "$PS1" ]; then - parent=$(ps -o ppid= -p $$) - name=$(ps -o comm= -p $parent) - case "$name" in sshd|login) exec tmux ;; esac -fi - Is it the case that exec tmux is not present at the end of bashrc? - - - - To verify that session locking after period of inactivity is configured in tmux, -run the following command: - -$ sudo grep lock-after-time /etc/tmux.conf - -The output should return the following: - -set -g lock-after-time 900 - -Then, verify that the /etc/tmux.conf file can be read by other users than root: - -$ sudo ls -al /etc/tmux.conf - Is it the case that lock-after-time is set to a value greater than 900 or zero? - - - - To verify that vlock is configured as a locking mechanism in tmux, run the following command: - -$ sudo grep lock-command /etc/tmux.conf - -The output should return the following: - -set -g lock-command vlock - -Then, verify that the /etc/tmux.conf file can be read by other users than root: - -$ sudo ls -al /etc/tmux.conf - Is it the case that lock-command is not set? - - - - To verify that tmux is not listed as allowed shell on the system -run the following command: -$ grep 'tmux$' /etc/shells -The output should be empty. - Is it the case that tmux is listed in /etc/shells? - - - - Run the following command to determine if the tmux package is installed: $ rpm -q tmux - Is it the case that the package is not installed? - - - - Inspect /proc/cmdline for any instances of -systemd.confirm_spawn=(1|yes|true|on) in the kernel boot arguments. -Presence of a systemd.confirm_spawn=(1|yes|true|on) indicates -that interactive boot is enabled at boot time. - Is it the case that Interactive boot is enabled at boot time? - - - - To ensure the system is configured to ignore the Ctrl-Alt-Del setting, -enter the following command: -$ sudo grep -i ctrlaltdelburstaction /etc/systemd/system.conf -The output should return: -CtrlAltDelBurstAction=none - Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed more than 7 times in 2 seconds.? - - - - To ensure the system is configured to mask the Ctrl-Alt-Del sequence, Check -that the ctrl-alt-del.target is masked and not active with the following -command: -sudo systemctl status ctrl-alt-del.target -The output should indicate that the target is masked and not active. It -might resemble following output: -ctrl-alt-del.target -Loaded: masked (/dev/null; bad) -Active: inactive (dead) - Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed? - - - - Inspect /etc/default/grub for any instances of -systemd.confirm_spawn=(1|yes|true|on) in the kernel boot arguments. -Presence of a systemd.confirm_spawn=(1|yes|true|on) indicates -that interactive boot is enabled at boot time and verify that -GRUB_DISABLE_RECOVERY=true to disable recovery boot. - Is it the case that Interactive boot is enabled at boot time? - - - - To check if authentication is required for single-user mode, run the following command: -$ grep sulogin /usr/lib/systemd/system/rescue.service -The output should be similar to the following, and the line must begin with -ExecStart and /usr/lib/systemd/systemd-sulogin-shell. - ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue - - -Then, verify that the rescue service is in the runlevel1.target. -Run the following command: -$ sudo grep "^Requires=.*rescue.service" /usr/lib/systemd/system/runlevel1.target -The output should be the following: -Requires=sysinit.target rescue.service - -Then, check if there is no custom runlevel1 target configured in systemd configuration. -Run the following command: -$ sudo grep -r "^runlevel1.target$" /etc/systemd/system -There should be no output. - -Then, check if there is no custom rescue service configured in systemd configuration. -Run the following command: -$ sudo grep -r "^rescue.service$" /etc/systemd/system -There should be no output. - Is it the case that the output is different? - - - - To check that the debug-shell service is disabled in system boot configuration, -You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,run the following command: -$ sudo systemctl is-enabled debug-shell -Output should indicate the debug-shell service has either not been installed, -or has been disabled at all runlevels, as shown in the example below: -$ sudo systemctl is-enabled debug-shell disabled - -Run the following command to verify debug-shell is not active (i.e. not running) through current runtime configuration: -$ sudo systemctl is-active debug-shell - -If the service is not running the command will return the following output: -inactive - -The service will also be masked, to check that the debug-shell is masked, run the following command: -$ sudo systemctl show debug-shell | grep "LoadState\|UnitFileState" - -If the service is masked the command will return the following outputs: - -LoadState=masked - -UnitFileState=masked - Is it the case that the "debug-shell" is loaded and not masked? - - - - To verify the INACTIVE setting, run the following command: -$ grep "INACTIVE" /etc/default/useradd -The output should indicate the INACTIVE configuration option is set -to an appropriate integer as shown in the example below: -$ grep "INACTIVE" /etc/default/useradd -INACTIVE= - Is it the case that the value of INACTIVE is greater than the expected value or is -1? - - - - To verify all accounts have unique names, run the following command: -$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d -No output should be returned. - Is it the case that a line is returned? - - - - Verify that the system is integrated with a centralized authentication mechanism -such as as Active Directory, Kerberos, Directory Server, etc. that has -automated account mechanisms in place. - Is it the case that the system is not using a centralized authentication mechanism, or it is not automated? - - - - To check the maximum password age, run the command: -$ grep PASS_MAX_DAYS /etc/login.defs -The profile requirement is . - Is it the case that PASS_MAX_DAYS is not set equal to or greater than the required value? - - - - To check the minimum password age, run the command: -$ grep PASS_MIN_DAYS /etc/login.defs - Is it the case that it is not equal to or greater than the required value? - - - - To check the minimum password length, run the command: -$ grep PASS_MIN_LEN /etc/login.defs -The DoD requirement is 15. - Is it the case that it is not set to the required value? - - - - To check the password warning age, run the command: -$ grep PASS_WARN_AGE /etc/login.defs -The DoD requirement is 7. - Is it the case that it is not set to the required value? - - - - To check that no password hashes are stored in -/etc/passwd, run the following command: -awk '!/\S:x|\*/ {print}' /etc/passwd -If it produces any output, then a password hash is -stored in /etc/passwd. - Is it the case that any stored hashes are found in /etc/passwd? - - - - To ensure all GIDs referenced in /etc/passwd are defined in /etc/group, -run the following command: -$ sudo pwck -qr -There should be no output. - Is it the case that GIDs referenced in /etc/passwd are returned as not defined in /etc/group? - - - - To verify that null passwords cannot be used, run the following command: - -$ grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth - -If this produces any output, it may be possible to log into accounts -with empty passwords. Remove any instances of the nullok option to -prevent logins with empty passwords. - Is it the case that NULL passwords can be used? - - - - To verify that null passwords cannot be used, run the following command: -$ sudo awk -F: '!$2 {print $1}' /etc/shadow -If this produces any output, it may be possible to log into accounts -with empty passwords. - Is it the case that Blank or NULL passwords can be used? - - - - To check for legacy lines in /etc/group, run the following command: - grep '^\+' /etc/group -The command should not return any output. - Is it the case that the file contains legacy lines? - - - - To check for legacy lines in /etc/passwd, run the following command: - grep '^\+' /etc/passwd -The command should not return any output. - Is it the case that the file contains legacy lines? - - - - To check for legacy lines in /etc/shadow, run the following command: - grep '^\+' /etc/shadow -The command should not return any output. - Is it the case that the file contains legacy lines? - - - - To check the system for the existence of any .netrc files, -run the following command: -$ sudo find /home -xdev -name .netrc - Is it the case that any .netrc files exist? - - - - Check the system for duplicate UID "0" assignments with the following command: -$ awk -F: '($3 == \"0\") {print}' /etc/passwd - Is it the case that any account other than root has a UID of 0? - - - - To verify that root's primary group is zero run the following command: - - grep '^root:' /etc/passwd | cut -d : -f 4 - -The command should return: - -0 - - Is it the case that root has a primary gid not equal to zero? - - - - To ensure root may not directly login to the system over physical consoles, -run the following command: -cat /etc/securetty -If any output is returned, this is a finding. - Is it the case that the /etc/securetty file is not empty? - - - - To obtain a listing of all users and the contents of their shadow password -field, run the command: -$ sudo awk -F: '$1 !~ /^root$/ && $2 !~ /^[!*]/ {print $1 ":" $2}' /etc/shadow -Identify the system accounts from this listing. These will primarily be the accounts -with UID numbers less than UID_MIN, other than root. Value of the UID_MIN -directive is set in /etc/login.defs configuration file. In the default -configuration, UID_MIN is set to 500. - Is it the case that it is not? - - - - To obtain a listing of all users, their UIDs, and their shells, run the -command: $ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd Identify -the system accounts from this listing. These will primarily be the accounts -with UID numbers less than UID_MIN, other than root. Value of the UID_MIN -directive is set in /etc/login.defs configuration file. In the default -configuration UID_MIN is set to 1000. - Is it the case that any system account (other than root) has a login shell? - - - - To check for serial port entries which permit root login, -run the following command: -$ sudo grep ^ttyS/[0-9] /etc/securetty -If any output is returned, then root login over serial ports is permitted. - Is it the case that root login over serial ports is permitted? - - - - To check for virtual console entries which permit root login, run the -following command: -$ sudo grep ^vc/[0-9] /etc/securetty -If any output is returned, then root logins over virtual console devices is permitted. - Is it the case that root login over virtual console devices is permitted? - - - - To ensure write permissions are disabled for group and other - for each element in root's path, run the following command: -# ls -ld DIR - Is it the case that group or other write permissions exist? - - - - Verify the umask setting is configured correctly in the /etc/bashrc file by -running the following command: -$ sudo grep "umask" /etc/bashrc -All output must show the value of umask set as shown below: -umask - Is it the case that the above command returns no output, or the umask is configured incorrectly? - - - - Verify the umask setting is configured correctly in the /etc/csh.cshrc file by -running the following command: -$ sudo grep "umask" /etc/csh.cshrc -All output must show the value of umask set as shown in the below: -umask - Is it the case that the above command returns no output, or the umask is configured incorrectly? - - - - Verify the UMASK setting is configured correctly in the /etc/login.defs file by -running the following command: -$ sudo grep "UMASK" /etc/login.defs -All output must show the value of UMASK set as shown in the below: -UMASK - Is it the case that the above command returns no output, or the umask is configured incorrectly? - - - - Verify the umask setting is configured correctly in the /etc/profile file by -running the following command: -$ sudo grep "umask" /etc/profile -All output must show the value of umask set as shown in the below: -umask - Is it the case that the above command returns no output, or the umask is configured incorrectly? - - - - Verify the FAIL_DELAY setting is configured correctly in the /etc/login.defs file by -running the following command: -$ sudo grep -i "FAIL_DELAY" /etc/login.defs -All output must show the value of FAIL_DELAY set as shown in the below: -$ sudo grep -i "FAIL_DELAY" /etc/login.defs -FAIL_DELAY - Is it the case that the above command returns no output, or FAIL_DELAY is configured less than the expected value? - - - - Run the following command to ensure the maxlogins value is -configured for all users on the system: -# grep "maxlogins" /etc/security/limits.conf /etc/security/limits.d/*.conf -You should receive output similar to the following: -*\t\thard\tmaxlogins\t - Is it the case that maxlogins is not equal to or less than the expected value? - - - - Run the following command to ensure that /tmp is configured as a -polyinstantiated directory: -$ sudo grep /tmp /etc/security/namespace.conf -The output should return the following: -/tmp /tmp/tmp-inst/ level root,adm - Is it the case that is not configured? - - - - Run the following command to ensure that /var/tmp is configured as a -polyinstantiated directory: -$ sudo grep /var/tmp /etc/security/namespace.conf -The output should return the following: -/var/tmp /var/tmp/tmp-inst/ level root,adm - Is it the case that is not configured? - - - - Run the following command to ensure the TMOUT value is configured for all users -on the system: - -$ sudo grep TMOUT /etc/profile /etc/profile.d/*.sh - -The output should return the following: -TMOUT= - Is it the case that TMOUT is not set or its value is greater than expected setting? - - - - To ensure the user home directory is not group-writable or world-readable, run the following: -# ls -ld /home/USER - Is it the case that the user home directory is group-writable or world-readable? - - - - To determine if the system is configured to audit calls to the -chmod system call, run the following command: -$ sudo grep "chmod" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -chown system call, run the following command: -$ sudo grep "chown" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -fchmod system call, run the following command: -$ sudo grep "fchmod" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -fchmodat system call, run the following command: -$ sudo grep "fchmodat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -fchown system call, run the following command: -$ sudo grep "fchown" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -fchownat system call, run the following command: -$ sudo grep "fchownat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -fremovexattr system call, run the following command: -$ sudo grep "fremovexattr" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -fsetxattr system call, run the following command: -$ sudo grep "fsetxattr" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -lchown system call, run the following command: -$ sudo grep "lchown" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -lremovexattr system call, run the following command: -$ sudo grep "lremovexattr" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -lsetxattr system call, run the following command: -$ sudo grep "lsetxattr" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -removexattr system call, run the following command: -$ sudo grep "removexattr" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -setxattr system call, run the following command: -$ sudo grep "setxattr" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify that Red Hat Enterprise Linux CoreOS 4 generates an audit record for all uses of the "umount" and system call. -To determine if the system is configured to audit calls to the -"umount" system call, run the following command: -$ sudo grep "umount" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line like the following. --a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -k privileged-umount - Is it the case that the command does not return a line, or the line is commented out? - - - - To determine if the system is configured to audit calls to the -umount2 system call, run the following command: -$ sudo grep "umount2" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for all uses of the "chcon" command. -To verify that execution of the command is being audited, run the following command: -$ sudo grep "path=/usr/bin/chcon" /etc/audit/audit.rules /etc/audit/rules.d/* -The output should return something similar to: --a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=unset -F key=perm_mod - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the restorecon command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w restorecon /etc/audit/audit.rules - --a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid>=1000 -F auid!=unset -k privileged-restorecon - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for all uses of the "semanage" command. -To verify that execution of the command is being audited, run the following command: -$ sudo grep "path=/usr/sbin/semanage" /etc/audit/audit.rules /etc/audit/rules.d/* -The output should return something similar to: --a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=unset -F key=perm_mod - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for all uses of the "setfiles" command. -To verify that execution of the command is being audited, run the following command: -$ sudo grep "path=/usr/sbin/setfiles" /etc/audit/audit.rules /etc/audit/rules.d/* -The output should return something similar to: --a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=unset -F key=privileged-setfiles - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for all uses of the "setsebool" command. -To verify that execution of the command is being audited, run the following command: -$ sudo grep "path=/usr/sbin/setsebool" /etc/audit/audit.rules /etc/audit/rules.d/* -The output should return something similar to: --a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=unset -F key=privileged - Is it the case that the command does not return a line, or the line is commented out? - - - - To verify that execution of the command is being audited, run the following command: -$ sudo grep "path=/usr/sbin/seunshare" /etc/audit/audit.rules /etc/audit/rules.d/* -The output should return something similar to: --a always,exit -F path=/usr/sbin/seunshare -F auid>=1000 -F auid!=unset -F key=privileged - Is it the case that ? - - - - To determine if the system is configured to audit calls to the -rmdir system call, run the following command: -$ sudo grep "rmdir" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. -To determine if the system is configured to audit calls to the -unlink system call, run the following command: -$ sudo grep "unlink" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. -To determine if the system is configured to audit calls to the -unlinkat system call, run the following command: -$ sudo grep "unlinkat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. -To determine if the system is configured to audit calls to the -rename system call, run the following command: -$ sudo grep "rename" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. -To determine if the system is configured to audit calls to the -renameat system call, run the following command: -$ sudo grep "renameat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -rename system call, run the following command: -$ sudo grep "rename" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -renameat system call, run the following command: -$ sudo grep "renameat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -rmdir system call, run the following command: -$ sudo grep "rmdir" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -unlink system call, run the following command: -$ sudo grep "unlink" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -unlinkat system call, run the following command: -$ sudo grep "unlinkat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To verify that the audit system collects unauthorized file accesses, run the following commands: -$ sudo grep EACCES /etc/audit/audit.rules -$ sudo grep EPERM /etc/audit/audit.rules - Is it the case that 32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM? - - - - To determine if the system is configured to audit unsuccessful calls -to the chmod system call, run the following command: -$ sudo grep "chmod" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the chown system call, run the following command: -$ sudo grep "chown" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the creat system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r creat /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep creat /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access - Is it the case that the command does not return a line, or the line is commented out? - - - - To determine if the system is configured to audit unsuccessful calls -to the fchmod system call, run the following command: -$ sudo grep "fchmod" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the fchmodat system call, run the following command: -$ sudo grep "fchmodat" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the fchown system call, run the following command: -$ sudo grep "fchown" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the fchownat system call, run the following command: -$ sudo grep "fchownat" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the fremovexattr system call, run the following command: -$ sudo grep "fremovexattr" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the fsetxattr system call, run the following command: -$ sudo grep "fsetxattr" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the ftruncate system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r ftruncate /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep ftruncate /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access - Is it the case that the command does not return a line, or the line is commented out? - - - - To determine if the system is configured to audit unsuccessful calls -to the lchown system call, run the following command: -$ sudo grep "lchown" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the lremovexattr system call, run the following command: -$ sudo grep "lremovexattr" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit unsuccessful calls -to the lsetxattr system call, run the following command: -$ sudo grep "lsetxattr" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the open system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r open /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep open /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the open_by_handle_at system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r open_by_handle_at /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep open_by_handle_at /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to create files using the open_by_handle_at system call with O_CREAT flag. - -If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r open_by_handle_at /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep open_by_handle_at /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to modify files using the open_by_handle_at system call with O_TRUNC_WRITE flag. - -If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r open_by_handle_at /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep open_by_handle_at /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that rules for unsuccessful calls of the open_by_handle_at syscall are in the order shown below. - - If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix ".rules" in the directory "/etc/audit/rules.d". - If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, check the order of rules below in "/etc/audit/audit.rules" file. - - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b32 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - - If the system is 64 bit then also add the following lines: - - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b64 -S open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - Is it the case that the rules are in a different order? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to create files using the open system call with O_CREAT flag. - -If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r open /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep open /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to modify files using the open system call with O_TRUNC_WRITE flag. - -If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r open /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep open /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that rules for unsuccessful calls of the open syscall are in the order shown below. - - If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix ".rules" in the directory "/etc/audit/rules.d". - If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, check the order of rules below in "/etc/audit/audit.rules" file. - - -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - - If the system is 64 bit then also add the following lines: - - -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - Is it the case that the rules are in a different order? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the openat system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r openat /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep openat /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to create files using the openat system call with O_CREAT flag. - -If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r openat /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep openat /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to modify files using the openat system call with O_TRUNC_WRITE flag. - -If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r openat /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep openat /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create --a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that rules for unsuccessful calls of the openat syscall are in the order shown below. - - If the auditd daemon is configured to use the "augenrules" program to read audit rules during daemon startup (the default), check the order of rules below in a file with suffix ".rules" in the directory "/etc/audit/rules.d". - If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, check the order of rules below in "/etc/audit/audit.rules" file. - - -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b32 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b32 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - - If the system is 64 bit then also add the following lines: - - -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b64 -S openat -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-create - -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b64 -S openat -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-modification - -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-access - Is it the case that the rules are in a different order? - - - - To determine if the system is configured to audit unsuccessful calls -to the removexattr system call, run the following command: -$ sudo grep "removexattr" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the rename system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r rename /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep rename /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the renameat system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r renameat /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep renameat /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete - Is it the case that the command does not return a line, or the line is commented out? - - - - To determine if the system is configured to audit unsuccessful calls -to the setxattr system call, run the following command: -$ sudo grep "setxattr" /etc/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the truncate system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r truncate /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep truncate /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access --a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the unlink system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r unlink /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep unlink /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates an audit record for unsuccessful attempts to use the unlinkat system call. - -If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command: - -$ sudo grep -r unlinkat /etc/audit/rules.d - -If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command: - -$ sudo grep unlinkat /etc/audit/audit.rules - -The output should be the following: - --a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete --a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k unsuccessful-delete - Is it the case that the command does not return a line, or the line is commented out? - - - - To determine if the system is configured to audit calls to the -init_module system call, run the following command: -$ sudo grep "init_module" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. -To determine if the system is configured to audit calls to the -delete_module system call, run the following command: -$ sudo grep "delete_module" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -delete_module system call, run the following command: -$ sudo grep "delete_module" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -finit_module system call, run the following command: -$ sudo grep "finit_module" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -init_module system call, run the following command: -$ sudo grep "init_module" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To verify that auditing is configured for system administrator actions, run the following command: -$ sudo auditctl -l | grep "watch=/var/run/faillock\|-w /var/run/faillock" - Is it the case that there is no output? - - - - To verify that auditing is configured for system administrator actions, run the following command: -$ sudo auditctl -l | grep "watch=/var/log/lastlog\|-w /var/log/lastlog" - Is it the case that there is not output? - - - - To verify that auditing is configured for system administrator actions, run the following command: -$ sudo auditctl -l | grep "watch=/var/log/tallylog\|-w /var/log/tallylog" - Is it the case that there is not output? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the init command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w init /etc/audit/audit.rules - --a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the poweroff command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w poweroff /etc/audit/audit.rules - --a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the reboot command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w reboot /etc/audit/audit.rules - --a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the shutdown command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w shutdown /etc/audit/audit.rules - --a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown - Is it the case that the command does not return a line, or the line is commented out? - - - - To verify that auditing of privileged command use is configured, run the -following command for each local partition PART to find relevant -setuid / setgid programs: -$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null -Run the following command to verify entries in the audit rules for all programs -found with the previous command: -$ sudo grep path /etc/audit/audit.rules -All relevant setuid / setgid programs have a line -in the audit rules. - Is it the case that any setuid or setgid programs doesn't have a line in the audit rules? - - - - To verify that auditing of privileged command use is configured, run the -following command: -$ sudo grep '\bat\b' /etc/audit/audit.rules /etc/audit/rules.d/* -It should return a relevant line in the audit rules. - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the chage command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w chage /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the chsh command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w chsh /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chsh - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the crontab command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w crontab /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the gpasswd command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w gpasswd /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the mount command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w mount /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount - Is it the case that the command does not return a line, or the line is commented out? - - - - To verify that auditing of privileged command use is configured, run the -following command: -$ sudo grep newgidmap /etc/audit/audit.rules /etc/audit/rules.d/* -It should return a relevant line in the audit rules. - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the newgrp command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w newgrp /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k privileged-newgrp - Is it the case that the command does not return a line, or the line is commented out? - - - - To verify that auditing of privileged command use is configured, run the -following command: -$ sudo grep newuidmap /etc/audit/audit.rules /etc/audit/rules.d/* -It should return a relevant line in the audit rules. - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the pam_timestamp_check command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w pam_timestamp_check /etc/audit/audit.rules - --a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the passwd command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w passwd /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the postdrop command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w postdrop /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postdrop - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the postqueue command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w postqueue /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postqueue - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the pt_chown command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w pt_chown /etc/audit/audit.rules - --a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pt_chown - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the ssh-keysign command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w ssh-keysign /etc/audit/audit.rules - --a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh-keysign - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the su command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w su /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-su - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the sudo command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w sudo /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-sudo - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the sudoedit command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w sudoedit /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k privileged-sudoedit - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the umount command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w umount /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-umount - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the unix_chkpwd command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w unix_chkpwd /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix_chkpwd - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify that an audit event is generated for any successful/unsuccessful use of the userhelper command by performing the following command to check the file system rules in "/etc/audit/audit.rules": - -$ sudo grep -w userhelper /etc/audit/audit.rules - --a always,exit -F path=/usr/bin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-userhelper - Is it the case that the command does not return a line, or the line is commented out? - - - - To verify that auditing of privileged command use is configured, run the -following command: -$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/* -It should return a relevant line in the audit rules. - Is it the case that the command does not return a line, or the line is commented out? - - - - To determine if the system is configured to audit calls to the -adjtimex system call, run the following command: -$ sudo grep "adjtimex" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -clock_settime system call, run the following command: -$ sudo grep "clock_settime" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -settimeofday system call, run the following command: -$ sudo grep "settimeofday" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - If the system is not configured to audit time changes, this is a finding. -If the system is 64-bit only, this is not applicable -ocil: | -To determine if the system is configured to audit calls to the -stime system call, run the following command: -$ sudo grep "stime" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - Is it the case that no line is returned? - - - - To determine if the system is configured to audit attempts to -alter time via the /etc/localtime file, run the following -command: -$ sudo auditctl -l | grep "watch=/etc/localtime" -If the system is configured to audit this activity, it will return a line. - Is it the case that the system is not configured to audit time changes? - - - - To determine if the system is configured to audit calls to the -open system call, run the following command: -$ sudo grep "open" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -open_by_handle_at system call, run the following command: -$ sudo grep "open_by_handle_at" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -openat system call, run the following command: -$ sudo grep "openat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -open system call, run the following command: -$ sudo grep "open" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -open_by_handle_at system call, run the following command: -$ sudo grep "open_by_handle_at" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -openat system call, run the following command: -$ sudo grep "openat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -open system call, run the following command: -$ sudo grep "open" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -open_by_handle_at system call, run the following command: -$ sudo grep "open_by_handle_at" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -openat system call, run the following command: -$ sudo grep "openat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -open system call, run the following command: -$ sudo grep "open" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -open_by_handle_at system call, run the following command: -$ sudo grep "open_by_handle_at" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit calls to the -openat system call, run the following command: -$ sudo grep "openat" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - Verify the audit system prevents unauthorized changes with the following command: - -$ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1 - --e 2 - Is it the case that the audit system is not set to be immutable by adding the "-e 2" option to the "/etc/audit/audit.rules"? - - - - To determine if the system is configured to audit changes to its SELinux -configuration files, run the following command: -$ sudo auditctl -l | grep "dir=/etc/selinux" -If the system is configured to watch for changes to its SELinux -configuration, a line should be returned (including -perm=wa indicating permissions that are watched). - Is it the case that the system is not configured to audit attempts to change the MAC policy? - - - - To determine if the system is configured to audit calls to the -mount system call, run the following command: -$ sudo grep "mount" /etc/audit/audit.* -If the system is configured to audit this activity, it will return a line. - - Is it the case that no line is returned? - - - - To determine if the system is configured to audit changes to its network configuration, -run the following command: -auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)' -If the system is configured to watch for network configuration changes, a line should be returned for -each file specified (and perm=wa should be indicated for each). - Is it the case that the system is not configured to audit changes of the network configuration? - - - - To verify that auditing is configured for system administrator actions, run the following command: -$ sudo auditctl -l | grep "watch=/etc/sudoers\|watch=/etc/sudoers.d\|-w /etc/sudoers\|-w /etc/sudoers.d" - Is it the case that there is not output? - - - - To determine if the system is configured to audit account changes, -run the following command: -auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)' -If the system is configured to watch for account changes, lines should be returned for -each file specified (and with perm=wa for each). - Is it the case that the system is not configured to audit account changes? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" with the following command: - -$ sudo auditctl -l | egrep '(/etc/group)' - --w /etc/group -p wa -k identity - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command: - -$ sudo auditctl -l | egrep '(/etc/gshadow)' - --w /etc/gshadow -p wa -k identity - -If the command does not return a line, or the line is commented out, this is a finding. - Is it the case that the system is not configured to audit account changes? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command: - -$ sudo auditctl -l | egrep '(/etc/security/opasswd)' - --w /etc/security/opasswd -p wa -k identity - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command: - -$ sudo auditctl -l | egrep '(/etc/passwd)' - --w /etc/passwd -p wa -k identity - Is it the case that the command does not return a line, or the line is commented out? - - - - Verify Red Hat Enterprise Linux CoreOS 4 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd with the following command: - -$ sudo auditctl -l | egrep '(/etc/shadow)' - --w /etc/shadow -p wa -k identity - Is it the case that command does not return a line, or the line is commented out? - - - - To determine if the system is configured to audit accesses to -/var/log/audit directory, run the following command: -$ sudo grep "dir=/var/log/audit" /etc/audit/audit.rules -If the system is configured to audit this activity, it will return a line. - Is it the case that no line is returned? - - - - Verify the audit log directories have a correct mode or less permissive mode. - -Find the location of the audit logs: - -$ sudo grep "^log_file" /etc/audit/auditd.conf - - -Find the group that owns audit logs: - -$ sudo grep "^log_group" /etc/audit/auditd.conf - - -Run the following command to check the mode of the system audit logs: - -$ sudo stat -c "%a %n" [audit_log_directory] - -Replace "[audit_log_directory]" to the correct audit log directory path, by default this location is "/var/log/audit". - - -If the log_group is "root" or is not set, the correct permissions are 0700, otherwise they are 0750. - Is it the case that audit logs have a more permissive mode? - - - - -To properly set the group owner of /etc/audit/, run the command: -$ sudo chgrp root /etc/audit/ - -To properly set the group owner of /etc/audit/rules.d/, run the command: -$ sudo chgrp root /etc/audit/rules.d/ - Is it the case that ? - - - - -To properly set the owner of /etc/audit/, run the command: -$ sudo chown root /etc/audit/ - -To properly set the owner of /etc/audit/rules.d/, run the command: -$ sudo chown root /etc/audit/rules.d/ - Is it the case that ? - - - - -To properly set the owner of /var/log/audit, run the command: -$ sudo chown root /var/log/audit - -To properly set the owner of /var/log/audit/*, run the command: -$ sudo chown root /var/log/audit/* - Is it the case that ? - - - - Run the following command to check the mode of the system audit logs: -$ sudo grep -iw log_file /etc/audit/auditd.conf -log_file=/var/log/audit/audit.log -$ sudo stat -c "%n %a" /var/log/audit/* -$ sudo ls -l /var/log/audit -Audit logs must be mode 0640 or less permissive. - Is it the case that any permissions are more permissive? - - - - To verify the audispd plugin off-loads audit records onto a different system or -media from the system being audited, run the following command: -$ sudo grep -i remote_server /etc/audit/audisp-remote.conf -The output should return something similar to -remote_server = - Is it the case that audispd is not sending logs to a remote system? - - - - Inspect /etc/audit/audisp-remote.conf and locate the following line to -determine if the system is configured to either send to syslog, switch to single user mode, -or halt when the disk is full: -$ sudo grep -i disk_full_action /etc/audit/audisp-remote.conf -The output should return something similar to: -disk_full_action = single -Acceptable values also include syslog and halt. - Is it the case that the system is not configured to switch to single user mode for corrective action? - - - - To verify the audispd plugin encrypts audit records off-loaded onto a different -system or media from the system being audited, run the following command: - -$ sudo grep -i enable_krb5 /etc/audit/audisp-remote.conf -The output should return the following: -enable_krb5 = yes - Is it the case that audispd is not encrypting audit records when sent over the network? - - - - Inspect /etc/audit/audisp-remote.conf and locate the following line to -determine if the system is configured to perform a correct action according to the policy: -$ sudo grep -i network_failure_action /etc/audit/audisp-remote.conf -The output should return: -network_failure_action = - Is it the case that the system is not configured to switch to single user mode for corrective action? - - - - To verify the audispd's syslog plugin is active, run the following command: -$ sudo grep active /etc/audit/plugins.d/syslog.conf -If the plugin is active, the output will show yes. - Is it the case that it is not activated? - - - - Verify Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when an audit processing failure occurs. - -Check that Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when an audit processing failure occurs with the following command: - -$ sudo grep disk_error_action /etc/audit/auditd.conf - -disk_error_action = - -If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit process failure occurs. - Is it the case that there is no evidence of appropriate action? - - - - Verify Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when an audit processing failure occurs. - -Check that Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when an audit processing failure occurs with the following command: - -$ sudo grep disk_error_action /etc/audit/auditd.conf - -disk_error_action = HALT - -If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit process failure occurs. - Is it the case that there is no evidence of appropriate action? - - - - Verify Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when the audit storage volume is full. - -Check that Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when the audit storage volume is full with the following command: - -$ sudo grep disk_full_action /etc/audit/auditd.conf - -disk_full_action = - -If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full. - Is it the case that there is no evidence of appropriate action? - - - - Verify Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when the audit storage volume is full. - -Check that Red Hat Enterprise Linux CoreOS 4 takes the appropriate action when the audit storage volume is full with the following command: - -$ sudo grep disk_full_action /etc/audit/auditd.conf - -disk_full_action = HALT - -If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full. - Is it the case that there is no evidence of appropriate action? - - - - Verify that the Red Hat Enterprise Linux CoreOS 4 "auditd" service is configured to notify the SA and ISSO in the event of an audit processing failure. -Inspect /etc/audit/auditd.conf and locate the following line to -determine if the system is configured to send email to an -account when it needs to notify an administrator: -action_mail_acct = - Is it the case that auditd is not configured to send emails per identified actions? - - - - Inspect /etc/audit/auditd.conf and locate the following line to -determine if the system is configured to either suspend, switch to single user mode, -or halt when disk space has run low: -admin_space_left_action single - Is it the case that the system is not configured to switch to single user mode for corrective action? - - - - Inspect /etc/audit/auditd.conf and locate the following line to -determine if the system is configured to synchronize audit event data -with the log files on the disk: -$ sudo grep flush /etc/audit/auditd.conf -flush = DATA -Acceptable values are DATA, and SYNC. The setting is -case-insensitive. - Is it the case that auditd is not configured to synchronously write audit event data to disk? - - - - Inspect /etc/audit/auditd.conf and locate the following line to -determine how much data the system will retain in each audit log file: -$ sudo grep max_log_file /etc/audit/auditd.conf -max_log_file = 6 - Is it the case that the system audit data threshold has not been properly configured? - - - - Verify that the SA and ISSO (at a minimum) are notified when the audit storage volume is full. - -Check which action Red Hat Enterprise Linux CoreOS 4 takes when the audit storage volume is full with the following command: - -$ sudo grep max_log_file_action /etc/audit/auditd.conf -max_log_file_action = - Is it the case that the value of the "max_log_file_action" option is set to "ignore", "rotate", or "suspend", or the line is commented out? - - - - Verify that the SA and ISSO (at a minimum) are notified when the audit storage volume is full. - -Check which action Red Hat Enterprise Linux CoreOS 4 takes when the audit storage volume is full with the following command: - -$ sudo grep max_log_file_action /etc/audit/auditd.conf -max_log_file_action = - Is it the case that the value of the "max_log_file_action" option is set to "ignore", "rotate", or "suspend", or the line is commented out? - - - - Inspect /etc/audit/auditd.conf and locate the following line to -determine how many logs the system is configured to retain after rotation: -$ sudo grep num_logs /etc/audit/auditd.conf -num_logs = 5 - Is it the case that the system log file retention has not been properly configured? - - - - Inspect /etc/audit/auditd.conf and locate the following line to -determine if the system is configured correctly: -space_left SIZE_in_MB - Is it the case that the system is not configured a specfic size in MB to notify administrators of an issue? - - - - Inspect /etc/audit/auditd.conf and locate the following line to -determine if the system is configured to email the administrator when -disk space is starting to run low: -$ sudo grep space_left_action /etc/audit/auditd.conf -space_left_action -Acceptable values are email, suspend, single, and halt. - Is it the case that the system is not configured to send an email to the system administrator when disk space is starting to run low? - - - - To verify that Audit Daemon is configured to flush to disk after -every 50 records, run the following command: -$ sudo grep freq /etc/audit/auditd.conf -The output should return the following: -freq = 50 - Is it the case that freq isn't set to 50? - - - - To verify that Audit Daemon is configured to include local events, run the -following command: -$ sudo grep local_events /etc/audit/auditd.conf -The output should return the following: -local_events = yes - Is it the case that local_events isn't set to yes? - - - - To verify that Audit Daemon is configured to resolve all uid, gid, syscall, -architecture, and socket address information before writing the event to disk, -run the following command: -$ sudo grep log_format /etc/audit/auditd.conf -The output should return the following: -log_format = ENRICHED - Is it the case that log_format isn't set to ENRICHED? - - - - To verify that Audit Daemon is configured to record the hostname -in audit events, run the following command: -$ sudo grep name_format /etc/audit/auditd.conf -The output should return the following: -name_format = hostname - Is it the case that name_format isn't set to hostname? - - - - Verify the audit system is configured to take an appropriate action when the internal event queue is full: -$ sudo grep -i overflow_action /etc/audit/auditd.conf - -The output should contain overflow_action = syslog - -If the value of the "overflow_action" option is not set to syslog, -single, halt or the line is commented out, ask the System Administrator -to indicate how the audit logs are off-loaded to a different system or media. - Is it the case that auditd overflow action is not set correctly? - - - - To verify that Audit Daemon is configured to write logs to the disk, run the -following command: -$ sudo grep write_logs /etc/audit/auditd.conf -The output should return the following: -write_logs = yes - Is it the case that write_logs isn't set to yes? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules -The output has to be exactly as follows: -## Unsuccessful file access (any other opens) This has to go last. --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-3-access-success.rules -The output has to be exactly as follows: -## Successful file access (any other opens) This has to go last. -## These next two are likely to result in a whole lot of events --a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access --a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/10-base-config.rules -The output has to be exactly as follows: -## First rule - delete all --D - -## Increase the buffers to survive stress events. -## Make this bigger for busy systems --b 8192 - -## This determine how long to wait in burst of events ---backlog_wait_time 60000 - -## Set failure mode to syslog --f 1 - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules -The output has to be exactly as follows: -## Unsuccessful file creation (open with O_CREAT) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create --a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-1-create-success.rules -The output has to be exactly as follows: -## Successful file creation (open with O_CREAT) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b32 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S open -F a1&0100 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b32 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create --a always,exit -F arch=b64 -S creat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-create - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules -The output has to be exactly as follows: -## Unsuccessful file delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules -The output has to be exactly as follows: -## Successful file delete --a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete --a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -$ sudo cat /etc/audit/rules.d/11-loginuid.rules -The output has to be exactly as follows: -## Make the loginuid immutable. This prevents tampering with the auid. ---loginuid-immutable - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules -The output has to be exactly as follows: -## Unsuccessful file modifications (open for write or truncate) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-modification - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules -The output has to be exactly as follows: -## Successful file modifications (open for write or truncate) --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b32 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S open -F a1&01003 -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification --a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-modification - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/43-module-load.rules -The output has to be exactly as follows: -## These rules watch for kernel module insertion. By monitoring -## the syscall, we do not need any watches on programs. --a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load --a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load --a always,exit -F arch=b32 -S delete_module -F key=module-unload --a always,exit -F arch=b64 -S delete_module -F key=module-unload - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42.rules -The output has to be exactly as follows: -## The purpose of these rules is to meet the requirements for Operating -## System Protection Profile (OSPP)v4.2. These rules depends on having -## the following rule files copied to /etc/audit/rules.d: -## -## 10-base-config.rules, 11-loginuid.rules, -## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules, -## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules, -## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules, -## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules, -## 30-ospp-v42-5-perm-change-failed.rules, -## 30-ospp-v42-5-perm-change-success.rules, -## 30-ospp-v42-6-owner-change-failed.rules, -## 30-ospp-v42-6-owner-change-success.rules -## -## original copies may be found in /usr/share/audit/sample-rules/ - - -## User add delete modify. This is covered by pam. However, someone could -## open a file and directly create or modify a user, so we'll watch passwd and -## shadow for writes --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify - -## User enable and disable. This is entirely handled by pam. - -## Group add delete modify. This is covered by pam. However, someone could -## open a file and directly create or modify a user, so we'll watch group and -## gshadow for writes --a always,exit -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify --a always,exit -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify --a always,exit -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify - - -## Use of special rights for config changes. This would be use of setuid -## programs that relate to user accts. This is not all setuid apps because -## requirements are only for ones that affect system configuration. --a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes --a always,exit -F path=/usr/bin/at -F perm=x -F auid>=1000 -F auid!=unset -F key=special-config-changes - -## Privilege escalation via su or sudo. This is entirely handled by pam. - -## Watch for configuration changes to privilege escalation. --a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes --a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes - -## Audit log access --a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail -## Attempts to Alter Process and Session Initiation Information --a always,exit -F path=/var/run/utmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session --a always,exit -F path=/var/log/btmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session --a always,exit -F path=/var/log/wtmp -F perm=wa -F auid>=1000 -F auid!=unset -F key=session - -## Attempts to modify MAC controls --a always,exit -F dir=/etc/selinux/ -F perm=wa -F auid>=1000 -F auid!=unset -F key=MAC-policy - -## Software updates. This is entirely handled by rpm. - -## System start and shutdown. This is entirely handled by systemd - -## Kernel Module loading. This is handled in 43-module-load.rules - -## Application invocation. The requirements list an optional requirement -## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to -## state results from that policy. This would be handled entirely by -## that daemon. - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules -The output has to be exactly as follows: -## Unsuccessful ownership change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-owner-change - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules -The output has to be exactly as follows: -## Successful ownership change --a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change --a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-owner-change - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules -The output has to be exactly as follows: -## Unsuccessful permission change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-perm-change - Is it the case that the file does not exist or the content differs? - - - - To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command: -cat /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules -The output has to be exactly as follows: -## Successful permission change --a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change --a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change - Is it the case that the file does not exist or the content differs? - - - - To verify that audit is configured for OSPP v4.2.1, run the following commands: -for file in "10-base-config" "11-loginuid" "30-ospp-v42" "43-module-load";do diff /etc/audit/rules.d/$file.rules /usr/share/doc/audit*/rules/$file.rules; done - -If the system is configured properly, no lines should be returned. - Is it the case that the files are not there or differ? - - - - Inspect the form of all the BLS (Boot Loader Specification) entries -('options' line) in /boot/loader/entries/*.conf. If they include -audit=1, then auditing is enabled at boot time. - -To ensure audit_backlog_limit=8192 is configured on the installed kernel, add -the kernel argument via a MachineConfig object to the appropriate -pools. - Is it the case that audit backlog limit is not configured? - - - - Inspect the form of BLS (Boot Loader Specification) options lines for the Linux operating system -in /boot/loader/entries/*.conf. If they include audit=1, then auditing -is enabled at boot time. -# grep 'options.*audit=1.*' /boot/loader/entires/*.conf - - Is it the case that auditing is not enabled at boot time? - - - - Run the following command to determine if the audispd-plugins package is installed: $ rpm -q audispd-plugins - Is it the case that the package is not installed? - - - - - Is it the case that the package is not installed? - - - - Run the following command to determine if the audit package is installed: $ rpm -q audit - Is it the case that the audit package is not installed? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -auditd service: -$ sudo systemctl is-active auditd -If the service is running, it should return the following: active - Is it the case that the auditd service is not running? - - - - To verify the boot loader superuser account has been set, run the following -command: -sudo grep -A1 "superusers" /boot/grub2/grub.cfg -The output should show the following: -set superusers="superusers-account" -export superusers -where superusers-account is the actual account name different from common names like root, -admin, or administrator and different from any other existing user name. - Is it the case that superuser account is not set or is set to an existing name or to a common name? - - - - To verify the boot loader superuser password has been set, run the following command: -$ sudo grep "^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$" /boot/grub2/user.cfg -The output should be similar to: -GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC -2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0 -916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7 -0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828 - Is it the case that no password is set? - - - - Inspect the form of all the BLS (Boot Loader Specification) entries -('options' line) in /boot/loader/entries/*.conf. If they include -pti=on, then Kernel page-table isolation is enabled at boot time. - -To ensure pti=on is configured on the installed kernel, add -the kernel argument via a MachineConfig object to the appropriate -pools. - Is it the case that Kernel page-table isolation is not enabled? - - - - Inspect the form of all the BLS (Boot Loader Specification) entries -('options' line) in /boot/loader/entries/*.conf. If they include -vsyscall=none, then virtual syscalls are not enabled at boot time. - -To ensure vsyscall=none is configured on the installed kernel, add -the kernel argument via a MachineConfig object to the appropriate -pools. - Is it the case that vsyscalls are enabled? - - - - Verify that GRUB_DISABLE_RECOVERY is set to true in /etc/default/grub to disable recovery boot. -Run the following command: - -$ sudo grep GRUB_DISABLE_RECOVERY /etc/default/grub - Is it the case that GRUB_DISABLE_RECOVERY is not set to true or is missing? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include iommu=force, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*iommu=force.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that I/OMMU is not activated? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include l1tf=, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*l1tf=.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that l1tf mitigations are not configured appropriately? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include mce=0, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*mce=0.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that MCE tolerance is not set to zero? - - - - Make sure that the kernel is not disabling SMAP with the following -commands. -grep -q nosmap /boot/config-`uname -r` -If the command returns a line, it means that SMAP is being disabled. - Is it the case that the kernel is configured to disable SMAP? - - - - Make sure that the kernel is not disabling SMEP with the following -commands. -grep -q nosmep /boot/config-`uname -r` -If the command returns a line, it means that SMEP is being disabled. - Is it the case that the kernel is configured to disable SMEP? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include rng_core.default_quality=, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*rng_core.default_quality=.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that trust on hardware random number generator is not configured appropriately? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include slab_nomerge=yes, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*slab_nomerge=yes.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that merging of slabs with similar size is enabled? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include spec_store_bypass_disable=, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*spec_store_bypass_disable=.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that SSB is not configured appropriately? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include spectre_v2=on, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*spectre_v2=on.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that spectre_v2 mitigation is not enforced? - - - - Ensure that debug-shell service is not enabled with the following command: -grep systemd\.debug-shell=1 /boot/grub2/grubenv /etc/default/grub -If the command returns a line, it means that debug-shell service is being enabled. - Is it the case that the comand returns a line? - - - - To check that audit is enabled at boot time, check all boot entries with following command: -sudo grep -L "^options\s+.*\baudit=1\b" /boot/loader/entries/*.conf -No line should be returned, each line returned is a boot entry that doesn't enable audit. - Is it the case that auditing is not enabled at boot time? - - - - To check that all boot entries extend the backlog limit; -Check that all boot entries extend the log events queue: -sudo grep -L "^options\s+.*\baudit_backlog_limit=8192\b" /boot/loader/entries/*.conf -No line should be returned, each line returned is a boot entry that does not extend the log events queue. - Is it the case that audit backlog limit is not configured? - - - - Check that no boot image file is specified in /etc/zipl.conf: -grep -R "^image\s*=" /etc/zipl.conf -No line should be returned, if a line is returned non BLS compliant boot entries are configured for zIPL. - Is it the case that a non BLS boot entry is configured? - - - - Make sure that /boot/bootmap is newer than /boot/loader/entries/*.conf -and /etc/zipl.conf: -find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap -No line should be returned, if a line is returned /boot/bootmap is outdated and needs to be regenerated. - Is it the case that the bootmap is outdated? - - - - To check that SELinux is not disabled at boot time; -Check that no boot entry disables selinux: -sudo grep -L "^options\s+.*\bselinux=0\b" /boot/loader/entries/*.conf -No line should be returned, each line returned is a boot entry that disables SELinux. - Is it the case that SELinux is disabled at boot time? - - - - To check that page poisoning is enabled at boot time, check all boot entries with following command: -sudo grep -L "^options\s+.*\bpage_poison=1\b" /boot/loader/entries/*.conf -No line should be returned, each line returned is a boot entry that doesn't enable page poisoning. - Is it the case that page allocator poisoning is not enabled? - - - - To check that SLUB/SLAB poisoning is enabled, check all boot entries with following command; -sudo grep -L "^options\s+.*\bslub_debug=P\b" /boot/loader/entries/*.conf -No line should be returned, each line returned is a boot entry that does not enable poisoning. - Is it the case that SLUB/SLAB poisoning is not enabled? - - - - Ensure that debug-shell service is not enabled with the following command: -sudo grep -L "^options\s+.*\bsystemd.debug-shell=1\b" /boot/loader/entries/*.conf -No line should be returned, each line returned is a boot entry that enables the debug-shell. - Is it the case that the comand returns a line? - - - - To check that virtual syscalls are disabled at boot time, check all boot entries with following command: -sudo grep -L "^options\s+.*\bvsyscall=none\b" /boot/loader/entries/*.conf -No line should be returned, each line returned is a boot entry that doesn't disable virtual syscalls. - Is it the case that vsyscalls are enabled? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_ACPI_CUSTOM_METHOD /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_BINFMT_MISC /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_BUG /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_COMPAT_BRK /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_COMPAT_VDSO /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_DEBUG_CREDENTIALS /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_DEBUG_FS /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_DEBUG_LIST /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_DEBUG_NOTIFIERS /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_DEBUG_SG /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_DEFAULT_MMAP_MIN_ADDR /boot/config.* - - For each kernel installed, a line with value "65536" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_DEVKMEM /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_HIBERNATION /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_IA32_EMULATION /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_IPV6 /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_KEXEC /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_LEGACY_PTYS /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_MODULE_SIG /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_MODULE_SIG_ALL /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_MODULE_SIG_FORCE /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_MODULE_SIG_HASH /boot/config.* - - For each kernel installed, a line with value "" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_MODULE_SIG_KEY /boot/config.* - - For each kernel installed, a line with value "" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_MODULE_SIG_SHA512 /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_PAGE_POISONING_ZERO /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_PAGE_TABLE_ISOLATION /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_PANIC_ON_OOPS /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_PANIC_TIMEOUT /boot/config.* - - For each kernel installed, a line with value "" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_PROC_KCORE /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_RANDOMIZE_BASE /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_RANDOMIZE_MEMORY /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_RETPOLINE /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SECCOMP /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SECCOMP_FILTER /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SECURITY /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SECURITY_DMESG_RESTRICT /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SECURITY_YAMA /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SLUB_DEBUG /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_SYN_COOKIES /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config.* - - For each kernel installed, a line with value "y" should be returned. - - Is it the case that the kernel was not built with the required value? - - - - To determine the config value the kernel was built with, run the following command: - $ grep CONFIG_X86_VSYSCALL_EMULATION /boot/config.* - - Configs with value 'n' are not explicitly set in the file, so either commented lines or no - lines should be returned. - - Is it the case that the kernel was not built with the required value? - - - - Verify the operating system authenticates the remote logging server for off-loading audit logs with the following command: - -$ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf -The output should be -$/etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name - Is it the case that $ActionSendStreamDriverAuthMode in /etc/rsyslog.conf is not set to x509/name? - - - - Verify the operating system encrypts audit records off-loaded onto a different system -or media from the system being audited with the following commands: - -$ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf - -The output should be: - -/etc/rsyslog.conf:$ActionSendStreamDriverMode 1 - Is it the case that rsyslogd ActionSendStreamDriverMode is not set to 1? - - - - Verify the operating system encrypts audit records off-loaded onto a different system -or media from the system being audited with the following commands: - -$ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf - -The output should be: - -/etc/rsyslog.conf:$DefaultNetstreamDriver gtls - Is it the case that rsyslogd DefaultNetstreamDriver not set to gtls? - - - - The group-owner of all log files written by rsyslog should be . -These log files are determined by the second part of each Rule line in -/etc/rsyslog.conf and typically all appear in /var/log. -To see the group-owner of a given log file, run the following command: -$ ls -l LOGFILE - Is it the case that the group-owner is not correct? - - - - The owner of all log files written by rsyslog should be . -These log files are determined by the second part of each Rule line in -/etc/rsyslog.conf and typically all appear in /var/log. -To see the owner of a given log file, run the following command: -$ ls -l LOGFILE - Is it the case that the owner is not correct? - - - - The file permissions for all log files written by rsyslog should -be set to 600, or more restrictive. These log files are determined by the -second part of each Rule line in /etc/rsyslog.conf and typically -all appear in /var/log. To see the permissions of a given log -file, run the following command: -$ ls -l LOGFILE -The permissions should be 600, or more restrictive. - Is it the case that the permissions are not correct? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -systemd-journald service: -$ sudo systemctl is-active systemd-journald -If the service is running, it should return the following: active - Is it the case that the systemd-journald service is not running? - - - - To determine the status and frequency of logrotate, run the following command: -$ sudo grep logrotate /var/log/cron* -If logrotate is configured properly, output should include references to -/etc/cron.daily. - Is it the case that logrotate is not configured to run daily? - - - - Run the following command to determine if the syslog-ng-core package is installed: $ rpm -q syslog-ng-core - Is it the case that the package is not installed? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -syslog-ng service: -$ sudo systemctl is-active syslog-ng -If the service is running, it should return the following: active - Is it the case that the "syslog-ng" service is disabled, masked, or not started.? - - - - To ensure logs are sent to a remote host, examine the file -/etc/rsyslog.conf. -If using UDP, a line similar to the following should be present: - *.* @ -If using TCP, a line similar to the following should be present: - *.* @@ -If using RELP, a line similar to the following should be present: - *.* :omrelp: - Is it the case that no evidence that the audit logs are being off-loaded to another system or media? - - - - Run the following command to determine if the rsyslog package is installed: $ rpm -q rsyslog - Is it the case that the package is not installed? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -rsyslog service: -$ sudo systemctl is-active rsyslog -If the service is running, it should return the following: active - Is it the case that the "rsyslog" service is disabled, masked, or not started.? - - - - Run the following command to determine if the firewalld package is installed: $ rpm -q firewalld - Is it the case that the package is not installed? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -firewalld service: -$ sudo systemctl is-active firewalld -If the service is running, it should return the following: active - Is it the case that the "firewalld" service is disabled, masked, or not started.? - - - - Run the following command to determine if the libreswan package is installed: $ rpm -q libreswan - Is it the case that the package is not installed? - - - - If IPv6 is disabled, this is not applicable. - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -ip6tables service: -$ sudo systemctl is-active ip6tables -If the service is running, it should return the following: active - Is it the case that ? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -iptables service: -$ sudo systemctl is-active iptables -If the service is running, it should return the following: active - Is it the case that ? - - - - If IPv6 is disabled, this is not applicable. - -Inspect the file /etc/sysconfig/ip6tables to determine -the default policy for the INPUT chain. It should be set to DROP: -$ sudo grep ":INPUT" /etc/sysconfig/ip6tables - Is it the case that the default policy for the INPUT chain is not set to DROP? - - - - Inspect the file /etc/sysconfig/iptables to determine -the default policy for the INPUT chain. It should be set to DROP: -$ sudo grep ":INPUT" /etc/sysconfig/iptables - Is it the case that the default policy for the INPUT chain is not set to DROP? - - - - Run the following command to ensure the default FORWARD policy is DROP: -grep ":FORWARD" /etc/sysconfig/iptables -The output should be similar to the following: -$ sudo grep ":FORWARD" /etc/sysconfig/iptables -:FORWARD DROP [0:0 - Is it the case that the default policy for the FORWARD chain is not set to DROP? - - - - Run the following command to determine if the iptables package is installed: $ rpm -q iptables - Is it the case that the package is not installed? - - - - The runtime status of the net.ipv6.conf.all.accept_ra kernel parameter can be queried -by running the following command: -$ sysctl net.ipv6.conf.all.accept_ra -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv6.conf.all.accept_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter can be queried -by running the following command: -$ sysctl net.ipv6.conf.all.accept_source_route -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv6.conf.default.accept_ra kernel parameter can be queried -by running the following command: -$ sysctl net.ipv6.conf.default.accept_ra -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv6.conf.default.accept_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter can be queried -by running the following command: -$ sysctl net.ipv6.conf.default.accept_source_route -0. - - Is it the case that the correct value is not returned? - - - - Inspect the form of default GRUB 2 command line for the Linux operating system -in /boot/grub2/grubenv. -If they include ipv6.disable=1, then the parameter -is configured at boot time. -$ sudo grep 'kernelopts.*ipv6.disable=1.*' GRUBENV_FILE_LOCATION -Fill in GRUBENV_FILE_LOCATION based on information above. - Is it the case that IPv6 is not disabled? - - - - If the system uses IPv6, this is not applicable. - -If the system is configured to disable the -ipv6 kernel module, it will contain a line -of the form: -options ipv6 disable=1 -Such lines may be inside any file in /etc/modprobe.d or the -deprecated/etc/modprobe.conf. This permits insertion of the IPv6 -kernel module (which other parts of the system expect to be present), but -otherwise keeps it inactive. Run the following command to search for such -lines in all files in /etc/modprobe.d and the deprecated -/etc/modprobe.conf: -$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d - Is it the case that the ipv6 kernel module is not disabled? - - - - If the system uses IPv6, this is not applicable. - -If the system is configured to prevent the usage of the ipv6 on -network interfaces, it will contain a line of the form: -net.ipv6.conf.all.disable_ipv6 = 1 -Such lines may be inside any file in the /etc/sysctl.d directory. -This permits insertion of the IPv6 kernel module (which other parts of the -system expect to be present), but otherwise keeps all network interfaces -from using IPv6. Run the following command to search for such lines in all -files in /etc/sysctl.d: -$ grep -r ipv6 /etc/sysctl.d - Is it the case that the ipv6 support is disabled on all network interfaces? - - - - If the system uses IPv6, this is not applicable. - -If the system is configured to prevent the usage of the ipv6 on -network interfaces, it will contain a line of the form: -net.ipv6.conf.default.disable_ipv6 = 1 -Such lines may be inside any file in the /etc/sysctl.d directory. -This permits insertion of the IPv6 kernel module (which other parts of the -system expect to be present), but otherwise keeps network interfaces -from using IPv6. Run the following command to search for such lines in all -files in /etc/sysctl.d: -$ grep -r ipv6 /etc/sysctl.d - Is it the case that the ipv6 support is disabled by default on network interfaces? - - - - The runtime status of the net.ipv4.conf.all.accept_local kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.accept_local -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.accept_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.accept_source_route -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.arp_filter kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.arp_filter -. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.arp_ignore kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.arp_ignore -. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.log_martians kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.log_martians -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.route_localnet kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.route_localnet -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.rp_filter parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.rp_filter -The output of the command should indicate either: -net.ipv4.conf.all.rp_filter = 1 -or: -net.ipv4.conf.all.rp_filter = 2 -The output of the command should not indicate: -net.ipv4.conf.all.rp_filter = 0 - -The preferable way how to assure the runtime compliance is to have -correct persistent configuration, and rebooting the system. - -The persistent sysctl parameter configuration is performed by specifying the appropriate -assignment in any file located in the /etc/sysctl.d directory. -Verify that there is not any existing incorrect configuration by executing the following command: -$ grep -r '^\s*net.ipv4.conf.all.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d -The command should not find any assignments other than: -net.ipv4.conf.all.rp_filter = 1 -or: -net.ipv4.conf.all.rp_filter = 2 - -Conflicting assignments are not allowed. - Is it the case that the net.ipv4.conf.all.rp_filter is not set to 1 or 2 or is configured to be 0? - - - - The runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.secure_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.shared_media kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.shared_media -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.default.accept_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.default.accept_source_route -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.default.log_martians kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.default.log_martians -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.default.rp_filter kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.default.rp_filter -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.default.secure_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.default.shared_media kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.default.shared_media -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.icmp_echo_ignore_broadcasts -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.icmp_ignore_bogus_error_responses -1. - - Is it the case that the correct value is not returned? - - - - To verify that the operating system protects against or limits the effects of DoS -attacks by ensuring implementation of rate-limiting measures -on impacted network interfaces, run the following command: -# grep 'net.ipv4.tcp_invalid_ratelimit' /etc/sysctl.conf /etc/sysctl.d/* -The command should output the following line: -/etc/sysctl.conf:net.ipv4.tcp_invalid_ratelimit = -The file where the line has been found can differ, but it must be either /etc/sysctl.conf -or a file located under the /etc/sysctl.d/ directory. - Is it the case that rate limiting of duplicate TCP acknowledgments is not configured? - - - - The runtime status of the net.ipv4.tcp_syncookies kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.tcp_syncookies -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.all.send_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.all.send_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.conf.default.send_redirects kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.conf.default.send_redirects -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.ipv4.ip_forward kernel parameter can be queried -by running the following command: -$ sysctl net.ipv4.ip_forward -0. -The ability to forward packets is only appropriate for routers. - Is it the case that the correct value is not returned? - - - - -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Run the following command to determine the current status of the -ufw service: -$ sudo systemctl is-active ufw -If the service is running, it should return the following: active - Is it the case that the service is not enabled? - - - - -If the system is configured to prevent the loading of the atm kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r atm /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the can kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r can /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the firewire-core kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r firewire-core /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the rds kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r rds /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the sctp kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r sctp /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the tipc kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r tipc /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the bluetooth kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the cfg80211 kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r cfg80211 /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the iwlmvm kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r iwlmvm /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the iwlwifi kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r iwlwifi /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the mac80211 kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r mac80211 /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - To check that the bluetooth service is disabled in system boot configuration, -You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,run the following command: -$ sudo systemctl is-enabled bluetooth -Output should indicate the bluetooth service has either not been installed, -or has been disabled at all runlevels, as shown in the example below: -$ sudo systemctl is-enabled bluetooth disabled - -Run the following command to verify bluetooth is not active (i.e. not running) through current runtime configuration: -$ sudo systemctl is-active bluetooth - -If the service is not running the command will return the following output: -inactive - -The service will also be masked, to check that the bluetooth is masked, run the following command: -$ sudo systemctl show bluetooth | grep "LoadState\|UnitFileState" - -If the service is masked the command will return the following outputs: - -LoadState=masked - -UnitFileState=masked - Is it the case that the "bluetooth" is loaded and not masked? - - - - Verify that there are no wireless interfaces configured on the system -with the following command: - -$ sudo nmcli device -The output should only contain wireless devices in unavailable state, like in the -following example: -wlp0s20f3 wifi unavailable -- - Is it the case that wireless interfaces are not active? - - - - Using a non-privileged account, verify that users cannot modify or change -network settings with the nmcli command with the following command: -$ nmcli general permissions -The output should contain the following: -PERMISSION VALUE -org.freedesktop.NetworkManager.enable-disable-network auth -org.freedesktop.NetworkManager.enable-disable-wifi auth -org.freedesktop.NetworkManager.enable-disable-wwan auth -org.freedesktop.NetworkManager.enable-disable-wimax auth -org.freedesktop.NetworkManager.sleep-wake auth -org.freedesktop.NetworkManager.network-control auth -org.freedesktop.NetworkManager.wifi.share.protected auth -org.freedesktop.NetworkManager.wifi.share.open auth -org.freedesktop.NetworkManager.settings.modify.system auth -org.freedesktop.NetworkManager.settings.modify.own auth -org.freedesktop.NetworkManager.settings.modify.hostname auth -org.freedesktop.NetworkManager.settings.modify.global-dns auth -org.freedesktop.NetworkManager.reload auth -org.freedesktop.NetworkManager.checkpoint-rollback auth -org.freedesktop.NetworkManager.enable-disable-statistics auth -org.freedesktop.NetworkManager.enable-disable-connectivity-check auth -org.freedesktop.NetworkManager.wifi.scan auth - - Is it the case that non-privileged users can modify or change network settings? - - - - To check the group ownership of /etc/group-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/group- -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/group- does not have a group owner of root? - - - - To check the group ownership of /etc/gshadow-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/gshadow- -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/gshadow- does not have a group owner of root? - - - - To check the group ownership of /etc/passwd-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/passwd- -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/passwd- does not have a group owner of root? - - - - To check the group ownership of /etc/shadow-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/shadow- -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/shadow- does not have a group owner of root? - - - - To check the group ownership of /etc/group, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/group -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/group does not have a group owner of root? - - - - To check the group ownership of /etc/gshadow, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/gshadow -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/gshadow does not have a group owner of root? - - - - To check the group ownership of /etc/passwd, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/passwd -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/passwd does not have a group owner of root? - - - - To check the group ownership of /etc/shadow, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/shadow -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /etc/shadow does not have a group owner of root? - - - - To check the ownership of /etc/group-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/group- -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/group- does not have an owner of root? - - - - To check the ownership of /etc/gshadow-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/gshadow- -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/gshadow- does not have an owner of root? - - - - To check the ownership of /etc/passwd-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/passwd- -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/passwd- does not have an owner of root? - - - - To check the ownership of /etc/shadow-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/shadow- -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/shadow- does not have an owner of root? - - - - To check the ownership of /etc/group, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/group -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/group does not have an owner of root? - - - - To check the ownership of /etc/gshadow, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/gshadow -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/gshadow does not have an owner of root? - - - - To check the ownership of /etc/passwd, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/passwd -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/passwd does not have an owner of root? - - - - To check the ownership of /etc/shadow, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /etc/shadow -If properly configured, the output should indicate the following owner: -root - Is it the case that /etc/shadow does not have an owner of root? - - - - To check the permissions of /etc/group-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/group- -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /etc/group- does not have unix mode -rw-r--r--? - - - - To check the permissions of /etc/gshadow-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/gshadow- -If properly configured, the output should indicate the following permissions: ----------- - Is it the case that /etc/gshadow- does not have unix mode ----------? - - - - To check the permissions of /etc/passwd-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/passwd- -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /etc/passwd- does not have unix mode -rw-r--r--? - - - - To check the permissions of /etc/shadow-, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/shadow- -If properly configured, the output should indicate the following permissions: ----------- - Is it the case that /etc/shadow- does not have unix mode ----------? - - - - To check the permissions of /etc/group, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/group -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /etc/group does not have unix mode -rw-r--r--? - - - - To check the permissions of /etc/gshadow, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/gshadow -If properly configured, the output should indicate the following permissions: ----------- - Is it the case that /etc/gshadow does not have unix mode ----------? - - - - To check the permissions of /etc/passwd, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/passwd -If properly configured, the output should indicate the following permissions: --rw-r--r-- - Is it the case that /etc/passwd does not have unix mode -rw-r--r--? - - - - To check the permissions of /etc/shadow, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /etc/shadow -If properly configured, the output should indicate the following permissions: ----------- - Is it the case that /etc/shadow does not have unix mode ----------? - - - - To check the group ownership of /var/log, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /var/log -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /var/log does not have a group owner of root? - - - - To check the group ownership of /var/log/messages, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /var/log/messages -If properly configured, the output should indicate the following group-owner: -root - Is it the case that /var/log/messages does not have a group owner of root? - - - - To check the group ownership of /var/log/syslog, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /var/log/syslog -If properly configured, the output should indicate the following group-owner: -adm - Is it the case that /var/log/syslog does not have a group owner of adm? - - - - To check the ownership of /var/log, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /var/log -If properly configured, the output should indicate the following owner: -root - Is it the case that /var/log does not have an owner of root? - - - - To check the ownership of /var/log/messages, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /var/log/messages -If properly configured, the output should indicate the following owner: -root - Is it the case that /var/log/messages does not have an owner of root? - - - - To check the ownership of /var/log/syslog, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -lL /var/log/syslog -If properly configured, the output should indicate the following owner: -syslog - Is it the case that /var/log/syslog does not have an owner of syslog? - - - - To check the permissions of /var/log, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /var/log -If properly configured, the output should indicate the following permissions: -drwxr-xr-x - Is it the case that /var/log does not have unix mode drwxr-xr-x? - - - - To check the permissions of /var/log/messages, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /var/log/messages -If properly configured, the output should indicate the following permissions: --rw-r----- - Is it the case that /var/log/messages does not have unix mode -rw-r-----? - - - - To check the permissions of /var/log/syslog, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /var/log/syslog -If properly configured, the output should indicate the following permissions: --rw-r----- - Is it the case that /var/log/syslog does not have unix mode -rw-r-----? - - - - System executables are stored in the following directories by default: -/bin -/sbin -/usr/bin -/usr/local/bin -/usr/local/sbin -/usr/sbin -For each of these directories, run the following command to find files -not owned by root: -$ sudo find -L DIR/ ! -user root -type d -exec chown root {} \; - Is it the case that any system executables directories are found to not be owned by root? - - - - Verify the system-wide shared library directories are owned by "root" with the following command: - -$ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \; - Is it the case that any system-wide shared library directory is not owned by root? - - - - System executables are stored in the following directories by default: -/bin -/sbin -/usr/bin -/usr/sbin -/usr/local/bin -/usr/local/sbin -To find system executables directories that are group-writable or -world-writable, run the following command for each directory DIR -which contains system executables: -$ sudo find -L DIR -perm /022 -type d - Is it the case that any of these files are group-writable or world-writable? - - - - Shared libraries are stored in the following directories: -/lib -/lib64 -/usr/lib -/usr/lib64 - -To find shared libraries that are group-writable or world-writable, -run the following command for each directory DIR which contains shared libraries: -$ sudo find -L DIR -perm /022 -type d - Is it the case that any of these files are group-writable or world-writable? - - - - Verify the system commands contained in the following directories are owned by "root" with the following command: - -$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec ls -l {} \; - Is it the case that any system commands are found to not be owned by root? - - - - Verify the system-wide shared library files are owned by "root" with the following command: - -$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root -exec ls -l {} \; - Is it the case that any system wide shared library file is not owned by root? - - - - Verify the system commands contained in the following directories have mode "755" or less permissive with the following command: - -$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l {} \; - Is it the case that any system commands are found to be group-writable or world-writable? - - - - Verify the system-wide shared library files contained in the following directories have mode "755" or less permissive with the following command: - -$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f -exec ls -l {} \; - Is it the case that any system-wide shared library file is found to be group-writable or world-writable? - - - - To find world-writable directories that lack the sticky bit, run the following command: -$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null - Is it the case that any world-writable directories are missing the sticky bit? - - - - To check the permissions of /boot/Sysem.map-*, -you'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Then,run the command: -$ ls -l /boot/Sysem.map-* -If properly configured, the output should indicate the following permissions: --rw------- - Is it the case that ? - - - - To find world-writable files, run the following command: -$ sudo find / -xdev -type f -perm -002 - Is it the case that there is output? - - - - The runtime status of the fs.protected_hardlinks kernel parameter can be queried -by running the following command: -$ sysctl fs.protected_hardlinks -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the fs.protected_symlinks kernel parameter can be queried -by running the following command: -$ sysctl fs.protected_symlinks -1. - - Is it the case that the correct value is not returned? - - - - -If the system is configured to prevent the loading of the cramfs kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r cramfs /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - -If the system is configured to prevent the loading of the usb-storage kernel module, -it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf. -These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event. - -Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf: -$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d - Is it the case that no line is returned? - - - - To check that the autofs service is disabled in system boot configuration, -You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,run the following command: -$ sudo systemctl is-enabled autofs -Output should indicate the autofs service has either not been installed, -or has been disabled at all runlevels, as shown in the example below: -$ sudo systemctl is-enabled autofs disabled - -Run the following command to verify autofs is not active (i.e. not running) through current runtime configuration: -$ sudo systemctl is-active autofs - -If the service is not running the command will return the following output: -inactive - -The service will also be masked, to check that the autofs is masked, run the following command: -$ sudo systemctl show autofs | grep "LoadState\|UnitFileState" - -If the service is masked the command will return the following outputs: - -LoadState=masked - -UnitFileState=masked - Is it the case that the "autofs" is loaded and not masked? - - - - Verify the nodev option is configured for the /boot mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/boot\s' - . . . /boot . . . nodev . . . - - Is it the case that the "/boot" file system does not have the "nodev" option set? - - - - Verify the nosuid option is configured for the /boot mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/boot\s' - . . . /boot . . . nosuid . . . - - Is it the case that the "/boot" file system does not have the "nosuid" option set? - - - - Verify the nodev option is configured for the /dev/shm mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/dev/shm\s' - . . . /dev/shm . . . nodev . . . - - Is it the case that the "/dev/shm" file system does not have the "nodev" option set? - - - - Verify the noexec option is configured for the /dev/shm mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/dev/shm\s' - . . . /dev/shm . . . noexec . . . - - Is it the case that the "/dev/shm" file system does not have the "noexec" option set? - - - - Verify the nosuid option is configured for the /dev/shm mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/dev/shm\s' - . . . /dev/shm . . . nosuid . . . - - Is it the case that the "/dev/shm" file system does not have the "nosuid" option set? - - - - Verify the nodev option is configured for the /home mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/home\s' - . . . /home . . . nodev . . . - - Is it the case that the "/home" file system does not have the "nodev" option set? - - - - Verify the nosuid option is configured for the /home mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/home\s' - . . . /home . . . nosuid . . . - - Is it the case that the "/home" file system does not have the "nosuid" option set? - - - - To verify the nodev option is configured for non-root local partitions, run the following command: -$ sudo mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev' -The output shows local non-root partitions mounted without the nodev option, and there should be no output at all. - - Is it the case that some mounts appear among output lines? - - - - Verify file systems that are used for removable media are mounted with the "nodev" option with the following command: - -$ sudo more /etc/fstab - -UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 - Is it the case that a file system found in "/etc/fstab" refers to removable media and it does not have the "nodev" option set? - - - - To verify that binaries cannot be directly executed from removable media, run the following command: -$ grep -v noexec /etc/fstab -The resulting output will show partitions which do not have the noexec flag. Verify all partitions -in the output are not removable media. - Is it the case that removable media partitions are present? - - - - Verify file systems that are used for removable media are mounted with the "nosuid" option with the following command: - -$ sudo more /etc/fstab - -UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid,nodev,noexec 0 0 - Is it the case that file system found in "/etc/fstab" refers to removable media and it does not have the "nosuid" option set? - - - - Verify the nodev option is configured for the /tmp mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/tmp\s' - . . . /tmp . . . nodev . . . - - Is it the case that the "/tmp" file system does not have the "nodev" option set? - - - - Verify the noexec option is configured for the /tmp mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/tmp\s' - . . . /tmp . . . noexec . . . - - Is it the case that the "/tmp" file system does not have the "noexec" option set? - - - - Verify the nosuid option is configured for the /tmp mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/tmp\s' - . . . /tmp . . . nosuid . . . - - Is it the case that the "/tmp" file system does not have the "nosuid" option set? - - - - Verify the nodev option is configured for the /var/log/audit mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/log/audit\s' - . . . /var/log/audit . . . nodev . . . - - Is it the case that the "/var/log/audit" file system does not have the "nodev" option set? - - - - Verify the noexec option is configured for the /var/log/audit mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/log/audit\s' - . . . /var/log/audit . . . noexec . . . - - Is it the case that the "/var/log/audit" file system does not have the "noexec" option set? - - - - Verify the nosuid option is configured for the /var/log/audit mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/log/audit\s' - . . . /var/log/audit . . . nosuid . . . - - Is it the case that the "/var/log/audit" file system does not have the "nosuid" option set? - - - - Verify the nodev option is configured for the /var/log mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/log\s' - . . . /var/log . . . nodev . . . - - Is it the case that the "/var/log" file system does not have the "nodev" option set? - - - - Verify the noexec option is configured for the /var/log mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/log\s' - . . . /var/log . . . noexec . . . - - Is it the case that the "/var/log" file system does not have the "noexec" option set? - - - - Verify the nosuid option is configured for the /var/log mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/log\s' - . . . /var/log . . . nosuid . . . - - Is it the case that the "/var/log" file system does not have the "nosuid" option set? - - - - Verify the nodev option is configured for the /var mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var\s' - . . . /var . . . nodev . . . - - Is it the case that the "/var" file system does not have the "nodev" option set? - - - - Verify the nosuid option is configured for the /var mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var\s' - . . . /var . . . nosuid . . . - - Is it the case that the "/var" file system does not have the "nosuid" option set? - - - - Verify the nodev option is configured for the /var/tmp mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/tmp\s' - . . . /var/tmp . . . nodev . . . - - Is it the case that the "/var/tmp" file system does not have the "nodev" option set? - - - - Verify the noexec option is configured for the /var/tmp mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/tmp\s' - . . . /var/tmp . . . noexec . . . - - Is it the case that the "/var/tmp" file system does not have the "noexec" option set? - - - - Verify the nosuid option is configured for the /var/tmp mount point, - You'll need to log into a node in the cluster. - As a user with administrator privileges, log into a node in the relevant pool: - - $ oc debug node/$NODE_NAME - - At the sh-4.4# prompt, run: - - # chroot /host - - - Subsequently,run the following command: - $ sudo mount | grep '\s/var/tmp\s' - . . . /var/tmp . . . nosuid . . . - - Is it the case that the "/var/tmp" file system does not have the "nosuid" option set? - - - - Verify that logging core dump backtraces is disabled, run the -following command: -$ grep ProcessSizeMax /etc/systemd/coredump.conf - Is it the case that ProcessSizeMax is not set to zero? - - - - Verify that storing core dumps are disabled, run the following command: -$ grep Storage /etc/systemd/coredump.conf - Is it the case that Storage is not set to none or is commented out and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement for all domains that have the "core" item assigned? - - - - Verify that core dumps are disabled for all users, run the following command: -$ grep core /etc/security/limits.conf -* hard core 0 - Is it the case that the "core" item is missing, commented out, or the value is anything other than "0" and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement for all domains that have the "core"? - - - - To verify that acquiring, saving, and processing core dumps is disabled, run the -following command: -$ systemctl status systemd-coredump.socket -The output should be similar to: -● systemd-coredump.socket - Loaded: masked (Reason: Unit systemd-coredump.socket is masked.) - Active: inactive (dead) ... - - Is it the case that unit systemd-coredump.socket is not masked or running? - - - - The runtime status of the fs.suid_dumpable kernel parameter can be queried -by running the following command: -$ sysctl fs.suid_dumpable -0. - - Is it the case that the correct value is not returned? - - - - The runtime status of the kernel.kptr_restrict kernel parameter can be queried -by running the following command: -$ sysctl kernel.kptr_restrict -The output of the command should indicate either: -kernel.kptr_restrict = 1 -or: -kernel.kptr_restrict = 2 -The output of the command should not indicate: -kernel.kptr_restrict = 0 - -The preferable way how to assure the runtime compliance is to have -correct persistent configuration, and rebooting the system. - -The persistent kernel parameter configuration is performed by specifying the appropriate -assignment in any file located in the /etc/sysctl.d directory. -Verify that there is not any existing incorrect configuration by executing the following command: -$ grep -r '^\s*kernel.kptr_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d -The command should not find any assignments other than: -kernel.kptr_restrict = 1 -or: -kernel.kptr_restrict = 2 - -Conflicting assignments are not allowed. - Is it the case that the kernel.kptr_restrict is not set to 1 or 2 or is configured to be 0? - - - - The runtime status of the kernel.randomize_va_space kernel parameter can be queried -by running the following command: -$ sysctl kernel.randomize_va_space -2. - - Is it the case that the correct value is not returned? - - - - Inspect the form of all the BLS (Boot Loader Specification) entries -('options' line) in /boot/loader/entries/*.conf. If they include -page_poison=1, then page poisoning is enabled at boot time. - -To ensure page_poison=1 is configured on the installed kernel, add -the kernel argument via a MachineConfig object to the appropriate -pools. - Is it the case that page allocator poisoning is not enabled? - - - - Inspect the form of all the BLS (Boot Loader Specification) entries -('options' line) in /boot/loader/entries/*.conf. If they include -slub_debug=P, then SLUB/SLAB poisoning is enabled at boot time. - -To ensure slub_debug=P is configured on the installed kernel, add -the kernel argument via a MachineConfig object to the appropriate -pools. - Is it the case that SLUB/SLAB poisoning is not enabled? - - - - If the device or Red Hat Enterprise Linux CoreOS 4 does not have a camera installed, this requirement is not applicable. - -This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision. - -This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed. - -For an external camera, if there is not a method for the operator to manually disconnect the camera at the end of collaborative computing sessions, this is a finding. - -For a built-in camera, the camera must be protected by a camera cover (e.g., laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or is not physically disabled, this is a finding. - -If the camera is not disconnected, covered, or physically disabled, determine if it is being disabled via software with the following commands: - -Verify the operating system disables the ability to load the uvcvideo kernel module. - -$ sudo grep -r uvcvideo /etc/modprobe.d/* | grep "/bin/true" - -install uvcvideo /bin/true - Is it the case that the command does not return any output, or the line is commented out, and the collaborative computing device has not been authorized for use? - - - - The runtime status of the kernel.core_pattern kernel parameter can be queried -by running the following command: -$ sysctl kernel.core_pattern -|/bin/false. - - Is it the case that the returned line does not have a value of "|/bin/false", or a line is not -returned and the need for core dumps is not documented with the Information -System Security Officer (ISSO) as an operational requirement? - - - - The runtime status of the kernel.core_pattern kernel parameter can be queried -by running the following command: -$ sysctl kernel.core_pattern -''. - - Is it the case that the returned line does not have a value of ''.? - - - - The runtime status of the kernel.core_uses_pid kernel parameter can be queried -by running the following command: -$ sysctl kernel.core_uses_pid -0. - Is it the case that the returned line does not have a value of 0? - - - - The runtime status of the kernel.dmesg_restrict kernel parameter can be queried -by running the following command: -$ sysctl kernel.dmesg_restrict -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the kernel.kexec_load_disabled kernel parameter can be queried -by running the following command: -$ sysctl kernel.kexec_load_disabled -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the kernel.panic_on_oops kernel parameter can be queried -by running the following command: -$ sysctl kernel.panic_on_oops -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the kernel.perf_event_paranoid kernel parameter can be queried -by running the following command: -$ sysctl kernel.perf_event_paranoid -2. - - Is it the case that the correct value is not returned? - - - - The runtime status of the kernel.unprivileged_bpf_disabled kernel parameter can be queried -by running the following command: -$ sysctl kernel.unprivileged_bpf_disabled -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the kernel.yama.ptrace_scope kernel parameter can be queried -by running the following command: -$ sysctl kernel.yama.ptrace_scope -1. - - Is it the case that the correct value is not returned? - - - - The runtime status of the net.core.bpf_jit_harden kernel parameter can be queried -by running the following command: -$ sysctl net.core.bpf_jit_harden -2. - - Is it the case that the correct value is not returned? - - - - Verify that Red Hat Enterprise Linux CoreOS 4 disables the use of user namespaces with the following commands: - -Note: User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable. - -The runtime status of the user.max_user_namespaces kernel parameter can be queried -by running the following command: -$ sysctl user.max_user_namespaces -0. - - Is it the case that the correct value is not returned? - - - - Inspect /proc/cmdline for any instances of selinux=0 -in the kernel boot arguments. Presence of selinux=0 indicates -that SELinux is disabled at boot time. - -If it would be disabled anywhere, make sure to enable it via a -MachineConfig object. - Is it the case that SELinux is disabled at boot time? - - - - Inspect /etc/default/grub for any instances of selinux=0 -in the kernel boot arguments. Presence of selinux=0 indicates -that SELinux is disabled at boot time. - Is it the case that SELinux is disabled at boot time? - - - - Run the following command to determine if the libselinux package is installed: $ rpm -q libselinux - Is it the case that the package is not installed? - - - - Run the following command to determine if the setroubleshoot-plugins package is installed: -$ rpm -q setroubleshoot-plugins - Is it the case that the package is installed? - - - - Run the following command to determine if the setroubleshoot-server package is installed: -$ rpm -q setroubleshoot-server - Is it the case that the package is installed? - - - - Ensure there are no unconfined daemons running on the system, -the following command should produce no output: -$ sudo ps -eZ | grep "unconfined_service_t" - Is it the case that There are unconfined daemons running on the system? - - - - Ensure that Red Hat Enterprise Linux CoreOS 4 verifies correct operation of security functions. - -Check the file /etc/selinux/config and ensure the following line appears: -SELINUXTYPE= - Is it the case that SELINUXTYPE is set to the wrong value? - - - - Ensure that Red Hat Enterprise Linux CoreOS 4 verifies correct operation of security functions. - -Check if "SELinux" is active and in "" mode with the following command: - -$ sudo getenforce - - Is it the case that SELINUX is not set to enforcing? - - - - Check the system partitions to determine if they are encrypted with the following command: -blkid - -Output will be similar to: -/dev/sda1: UUID=" ab12c3de-4f56-789a-8f33-3850cc8ce3a2 -" TYPE="crypto_LUKS" -/dev/sda2: UUID=" bc98d7ef-6g54-321h-1d24-9870de2ge1a2 -" TYPE="crypto_LUKS" - -The boot partition and pseudo-file systems, such as /proc, /sys, and tmpfs, -are not required to use disk encryption and are not a finding. - Is it the case that partitions do not have a type of crypto_LUKS? - - - - You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,Run the following command to determine if /home -is on its own partition or logical volume: -$ mount | grep "on /home" -If /home has its own partition or volume group, a line will be returned. - - Is it the case that no line is returned? - - - - You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,Run the following command to determine if /srv -is on its own partition or logical volume: -$ mount | grep "on /srv" -If /srv has its own partition or volume group, a line will be returned. - - Is it the case that no line is returned? - - - - You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,Run the following command to determine if /tmp -is on its own partition or logical volume: -$ mount | grep "on /tmp" -If /tmp has its own partition or volume group, a line will be returned. - - Is it the case that no line is returned? - - - - You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,Run the following command to determine if /var -is on its own partition or logical volume: -$ mount | grep "on /var" -If /var has its own partition or volume group, a line will be returned. - - Is it the case that no line is returned? - - - - You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,Run the following command to determine if /var/log -is on its own partition or logical volume: -$ mount | grep "on /var/log" -If /var/log has its own partition or volume group, a line will be returned. - - Is it the case that no line is returned? - - - - You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,Run the following command to determine if /var/log/audit -is on its own partition or logical volume: -$ mount | grep "on /var/log/audit" -If /var/log/audit has its own partition or volume group, a line will be returned. - - Is it the case that no line is returned? - - - - You'll need to log into a node in the cluster. -As a user with administrator privileges, log into a node in the relevant pool: - -$ oc debug node/$NODE_NAME - -At the sh-4.4# prompt, run: - -# chroot /host - - -Subsequently,Run the following command to determine if /var/tmp -is on its own partition or logical volume: -$ mount | grep "on /var/tmp" -If /var/tmp has its own partition or volume group, a line will be returned. - - Is it the case that no line is returned? - - - - To ensure that XDMCP is disabled in /etc/gdm/custom.conf, run the following command: -grep -Pzo "\[xdmcp\]\nEnable=false" /etc/gdm/custom.conf -The output should return the following: - -[xdmcp] -Enable=false - - Is it the case that the Enable is not set to false or is missing in the xdmcp section of the /etc/gdm/custom.conf gdm configuration file? - - - - To verify that the installed operating system is supported or certified, run -the following command: - -The output should contain something similar to: -Red Hat Enterprise Linux CoreOS 4 - Is it the case that the installed operating system is not FIPS 140-2 certified? - - - - To verify that BIND uses the system crypto policy, check out that the BIND config file -/etc/named.conf contains the include "/etc/crypto-policies/back-ends/bind.config"; -directive: -$ sudo grep 'include "/etc/crypto-policies/back-ends/bind.config";' /etc/named.conf -Verify that the directive is at the bottom of the options section of the config file. - Is it the case that BIND is installed and the BIND config file doesn't contain the -<pre>include "/etc/crypto-policies/back-ends/bind.config";</pre> directive? - - - - To verify that cryptography policy has been configured correctly, run the -following command: -$ update-crypto-policies --show -The output should return . -Run the command to check if the policy is correctly applied: -$ update-crypto-policies --is-applied -The output should be The configured policy is applied. -Moreover, check if settings for selected crypto policy are as expected. -List all libraries for which it holds that their crypto policies do not have symbolic link in /etc/crypto-policies/back-ends. -$ ls -l /etc/crypto-policies/back-ends/ | grep '^[^l]' | tail -n +2 | awk -F' ' '{print $NF}' | awk -F'.' '{print $1}' | sort -Subsequently, check if matching libraries have drop in files in the /etc/crypto-policies/local.d directory. -$ ls /etc/crypto-policies/local.d/ | awk -F'-' '{print $1}' | uniq | sort -Outputs of two previous commands should match. - Is it the case that cryptographic policy is not configured or is configured incorrectly? - - - - Check that the symlink exists and target the correct Kerberos crypto policy, with the following command: -file /etc/krb5.conf.d/crypto-policies -If command ouput shows the following line, Kerberos is configured to use the system-wide crypto policy. -/etc/krb5.conf.d/crypto-policies: symbolic link to /etc/crypto-policies/back-ends/krb5.config - Is it the case that the symlink does not exist or points to a different target? - - - - To verify that Libreswan uses the system crypto policy, run the following command: -$ grep include /etc/ipsec.conf -The output should return something similar to: -include /etc/crypto-policies/back-ends/libreswan.config - Is it the case that Libreswan is installed and <tt>/etc/ipsec.conf</tt> does not contain <tt>include /etc/crypto-policies/back-ends/libreswan.config</tt>? - - - - To verify that OpenSSL uses the system crypto policy, check out that the OpenSSL config file -/etc/pki/tls/openssl.cnf contains the [ crypto_policy ] section with the -.include /etc/crypto-policies/back-ends/opensslcnf.config directive: - -$ sudo grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf. - Is it the case that the OpenSSL config file doesn't contain the whole section, -or the section doesn't contain the <pre>.include /etc/crypto-policies/back-ends/opensslcnf.config</pre> directive? - - - - Verify that sshd isn't configured to ignore the system wide cryptographic policy. - -Check that the CRYPTO_POLICY variable is not set or is commented out in the -/etc/sysconfig/sshd. - -Run the following command: - -$ sudo grep CRYPTO_POLICY /etc/sysconfig/sshd - Is it the case that the CRYPTO_POLICY variable is set or is not commented out in the /etc/sysconfig/sshd? - - - - To verify if the OpenSSL uses defined Crypto Policy, run: -$ grep 'Ciphersuites' /etc/crypto-policies/back-ends/opensslcnf.config | tail -n 1 -and verify that the line matches -Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256 - Is it the case that Crypto Policy for OpenSSL is not configured according to CC requirements? - - - - To verify if the OpenSSH Client uses defined Crypto Policy, run: -$ cat /etc/ssh/ssh_config.d/02-ospp.conf -and verify that the line matches -Match final all -RekeyLimit 512M 1h -GSSAPIAuthentication no -Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc -PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -MACs hmac-sha2-512,hmac-sha2-256 -KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 - Is it the case that Crypto Policy for OpenSSH Client is not configured according to CC requirements? - - - - To verify if the OpenSSH server uses defined Crypto Policy, run: -$ grep 'CRYPTO_POLICY' /etc/crypto-policies/back-ends/opensshserver.config | tail -n 1 -and verify that the line matches -CRYPTO_POLICY='-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256' - Is it the case that Crypto Policy for OpenSSH Server is not configured according to CC requirements? - - - - To verify that McAfee HIPS is installed, run the following command(s): -$ rpm -q MFEhiplsm - Is it the case that the HBSS HIPS module is not installed? - - - - Verify that the system backups user data. - Is it the case that it is not? - - - - To verify that the Dracut FIPS module is enabled, run the following command: -grep "add_dracutmodules" /etc/dracut.conf.d/40-fips.conf -The output should look like this: -add_dracutmodules+=" fips " - Is it the case that the Dracut FIPS module is not enabled? - - - - To verify that FIPS mode is enabled properly, run the following command: -fips-mode-setup --check -The output should contain the following: -FIPS mode is enabled. -To verify that the cryptographic policy has been configured correctly, run the -following command: -$ update-crypto-policies --show -The output should return . - Is it the case that FIPS mode is not enabled? - - - - To verify /etc/system-fips exists, run the following command: -ls -l /etc/system-fips -The output should be similar to the following: --rw-r--r--. 1 root root 36 Nov 26 11:31 /etc/system-fips - Is it the case that /etc/system-fips does not exist? - - - - To verify that FIPS is enabled properly in grub, run the following command: -$ grep fips /etc/default/grub -The output should contain fips=1 - Is it the case that FIPS is not configured or enabled in grub? - - - - Run the following command to determine if the dracut-fips-aesni package is installed: $ rpm -q dracut-fips-aesni - Is it the case that the package is not installed? - - - - Run the following command to determine if the dracut-fips package is installed: $ rpm -q dracut-fips - Is it the case that the package is not installed? - - - - To verify that kernel parameter 'crypto.fips_enabled' is set properly, run the following command: -sysctl crypto.fips_enabled -The output should contain the following: -crypto.fips_enabled = 1 - Is it the case that crypto.fips_enabled is not 1? - - - - To find the location of the AIDE database file, run the following command: -$ sudo ls -l DBDIR/database_file_name - Is it the case that there is no database file? - - - - Run the following command to determine if the aide package is installed: $ rpm -q aide - Is it the case that the package is not installed? - - - - The following command will list which files on the system have ownership different from what -is expected by the RPM database: -$ rpm -Va | rpm -Va --nofiledigest | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }' - Is it the case that there is output? - - - - The following command will list which files on the system have permissions different from what -is expected by the RPM database: -$ rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }' - Is it the case that there is output? - - - - Run the following command to determine if the sudo package is installed: $ rpm -q sudo - Is it the case that the package is not installed? - - - - To determine if NOEXEC has been configured for sudo, run the following command: -$ sudo grep -ri "^[\s]*Defaults.*\bnoexec\b.*" /etc/sudoers /etc/sudoers.d/ -The command should return a matching output. - Is it the case that noexec is not enabled in sudo? - - - - To determine if requiretty has been configured for sudo, run the following command: -$ sudo grep -ri "^[\s]*Defaults.*\brequiretty\b.*" /etc/sudoers /etc/sudoers.d/ -The command should return a matching output. - Is it the case that requiretty is not enabled in sudo? - - - - To determine if use_pty has been configured for sudo, run the following command: -$ sudo grep -ri "^[\s]*Defaults.*\buse_pty\b.*" /etc/sudoers /etc/sudoers.d/ -The command should return a matching output. - Is it the case that use_pty is not enabled in sudo? - - - - To determine if logfile has been configured for sudo, run the following command: -$ sudo grep -ri "^[\s]*Defaults\s*\blogfile\b.*" /etc/sudoers /etc/sudoers.d/ -The command should return a matching output. - Is it the case that logfile is not enabled in sudo? - - - - To determine if !authenticate has not been configured for sudo, run the following command: -$ sudo grep -r \!authenticate /etc/sudoers /etc/sudoers.d/ -The command should return no output. - Is it the case that !authenticate is specified in the sudo config files? - - - - To determine if NOPASSWD has been configured for sudo, run the following command: -$ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/ -The command should return no output. - Is it the case that nopasswd is specified in the sudo config files? - - - - To determine if NOPASSWD or !authenticate have been configured for -sudo, run the following command: -$ sudo grep -ri "nopasswd\|\!authenticate" /etc/sudoers /etc/sudoers.d/ -The command should return no output. - Is it the case that nopasswd and/or !authenticate is enabled in sudo? - - - - To determine if NOPASSWD has been configured for the vdsm user for sudo, -run the following command: -$ sudo grep -ri nopasswd /etc/sudoers.d/ -The command should return output only for the vdsm user. - Is it the case that nopasswd is set for any users beyond vdsm? - - - - To determine if arguments that commands can be executed with are restricted, run the following command: -$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))' /etc/sudoers /etc/sudoers.d/ -The command should return no output. - Is it the case that /etc/sudoers file contains user specifications that allow execution of commands with any arguments? - - - - To determine if negation is used to define commands users are allowed to execute using sudo, run the following command: -$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*' /etc/sudoers /etc/sudoers.d/ -The command should return no output. - Is it the case that /etc/sudoers file contains rules that define the set of allowed commands using negation? - - - - To determine if the users are allowed to run commands as root, run the following commands: -$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]' /etc/sudoers /etc/sudoers.d/ -and -$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)' /etc/sudoers /etc/sudoers.d/ -Both commands should return no output. - Is it the case that /etc/sudoers file contains rules that allow non-root users to run commands as root? - - - - Run the following command to determine if the gnutls-utils package is installed: $ rpm -q gnutls-utils - Is it the case that the package is not installed? - - - - Run the following command to determine if the nss-tools package is installed: $ rpm -q nss-tools - Is it the case that the package is not installed? - - - - To ensure that the GPG key is installed, run: -$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey -The command should return the string below: -gpg(Red Hat, Inc. (release key 2) <security@redhat.com> - Is it the case that the Red Hat GPG Key is not installed? - - - - To check if the installed Operating System is 64-bit, run the following command: -$ uname -m -The output should be one of the following: x86_64, aarch64, ppc64le or s390x. -If the output is i686 or i386 the operating system is 32-bit. -Check if the installed CPU supports 64-bit operating systems by running the following command: -$ lscpu | grep "CPU op-mode" -If the output contains 64bit, the CPU supports 64-bit operating systems. - Is it the case that the installed operating sytem is 32-bit but the CPU supports operation in 64-bit? - - - - - - - - - combine_ovals.py from SCAP Security Guide - ssg: [0, 1, 64], python: 3.10.6 - 5.11 - 2022-08-11T18:55:18 - - - - - Alibaba Cloud Linux 2 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Alibaba Cloud Linux 2 - - - - - - - - - Alibaba Cloud Linux 3 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Alibaba Cloud Linux 3 - - - - - - - - - CentOS 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - CentOS 7 - - - - - - - - - CentOS 8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - CentOS 8 - - - - - - - - - - CentOS Stream 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - CentOS Stream 9 - - - - - - - - - - Debian - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed is a Debian System - - - - - - - - - Debian Linux 10 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Debian 10 - - - - - - - - - Debian Linux 11 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Debian 11 - - - - - - - - - Debian 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Debian 9 - - - - - - - - - Installed operating system is Fedora - - Red Hat Enterprise Linux CoreOS 4 - - - - - - The operating system installed on the system is Fedora - - - - - - - - - - Oracle Linux 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Oracle Linux 7 - - - - - - - - - - - Oracle Linux 8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Oracle Linux 8 - - - - - - - - - - - Oracle Linux 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Oracle Linux 9 - - - - - - - - - - - openSUSE - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed on the system is openSUSE. - - - - - - - - - openSUSE Leap 15 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is openSUSE Leap 15. - - - - - - - - - openSUSE Leap 42 - - Red Hat Enterprise Linux CoreOS 4 - - - - - The operating system installed on the system is openSUSE Leap 42. - - - - - - - - - Installed operating system is part of the Unix family - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed on the system is part of the Unix OS family - - - - - - - - Red Hat Enterprise Linux CoreOS - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux CoreOS release 4 - - - - - - - - - - - Red Hat Enterprise Linux 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux 7 - - - - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux 8 - - - - - - - - - - - - - - - Red Hat Enterprise Linux 8.0 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.0 - - - - - - - - Red Hat Enterprise Linux 8.1 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.1 - - - - - - - - Red Hat Enterprise Linux 8.2 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.2 - - - - - - - - Red Hat Enterprise Linux 8.3 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.3 - - - - - - - - Red Hat Enterprise Linux 8.4 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.4 - - - - - - - - Red Hat Enterprise Linux 8.5 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.5 - - - - - - - - Red Hat Enterprise Linux 8.6 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.6 - - - - - - - - Red Hat Enterprise Linux 8.7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.7 - - - - - - - - Red Hat Enterprise Linux 8.8 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.8 - - - - - - - - Red Hat Enterprise Linux 8.9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.9 - - - - - - - - Red Hat Enterprise Linux 8.10 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Red Hat Enterprise Linux 8.10 - - - - - - - - Red Hat Enterprise Linux 9 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Enterprise Linux 9 - - - - - - - - - - - - - - - Red Hat Virtualization 4 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host. - - - - - - - - - Scientific Linux 7 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is - Scientific Linux 7 - - - - - - - - - SUSE Linux Enterprise 12 - - Red Hat Enterprise Linux CoreOS 4 - - - - The operating system installed on the system is - SUSE Linux Enterprise 12. - - - - - - - - - - - - - SUSE Linux Enterprise 15 - - Red Hat Enterprise Linux CoreOS 4 - - - - The operating system installed on the system is - SUSE Linux Enterprise 15. - - - - - - - - - - - - - Ubuntu - - Red Hat Enterprise Linux CoreOS 4 - - The operating system installed is an Ubuntu System - - - - - - - - - - Ubuntu 1604 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Ubuntu 1604 - - - - - - - - - Ubuntu 1804 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Ubuntu 1804 - - - - - - - - - Ubuntu 2004 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is Ubuntu 2004 - - - - - - - - - UnionTech OS Server 20 - - Red Hat Enterprise Linux CoreOS 4 - - - The operating system installed on the system is UnionTech OS Server 20 - - - - - - - - - Red Hat Virtualization 4 - - Red Hat Enterprise Linux CoreOS 4 - - - The application installed installed on the system is - Red Hat Virtualization 4. - - - - - - - - - Package audit is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package audit is installed. - - - - - - - - - Package chrony is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package chrony is installed. - - - - - - - - - Package gdm is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package gdm is installed. - - - - - - - - - Package grub2 is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package grub2-common is installed. - - - - - - - - - - - - - Package libuser is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package libuser is installed. - - - - - - - - - Package providing /etc/login.defs is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package providing /etc/login.defs and is installed. - - - - - - - - - Package net-snmp is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package net-snmp is installed. - - - - - - - - - Check if the system doesn't act as an oVirt host or manager - - Red Hat Enterprise Linux CoreOS 4 - - Check if the system has neither ovirt-host nor ovirt-engine installed. - - - - - - - - Package nss-pam-ldapd is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package nss-pam-ldapd is installed. - - - - - - - - - Package ntp is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package ntp is installed. - - - - - - - - - Check if the system acts as an oVirt host or manager - - Red Hat Enterprise Linux CoreOS 4 - - Check if the system has ovirt-host or ovirt-engine installed - - - - - - - - - - Package pam is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package pam is installed. - - - - - - - - - Package polkit is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package polkit is installed. - - - - - - - - - Package postfix is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package postfix is installed. - - - - - - - - - Package sssd-common is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package sssd-common is installed. - - - - - - - - - Package sudo is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package sudo is installed. - - - - - - - - - Package systemd is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package systemd is installed. - - - - - - - - - Package tftp-server is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package tftp-server is installed. - - - - - - - - - Package tmux is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package tmux is installed. - - - - - - - - - Package usbguard is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package usbguard is installed. - - - - - - - - - WiFi interface is present - - Red Hat Enterprise Linux CoreOS 4 - - Checks if any wifi interface is present. - - - - - - - - - Package yum is installed - - Red Hat Enterprise Linux CoreOS 4 - - Checks if package yum is installed. - - - - - - - - - System uses zIPL - - Red Hat Enterprise Linux CoreOS 4 - - Checks if system uses zIPL bootloader. - - - - - - - - - Check if the scan target is a container - - Red Hat Enterprise Linux CoreOS 4 - - Check for presence of files characterizing container filesystems. - - - - - - - - - - Check if the scan target is a machine - - Red Hat Enterprise Linux CoreOS 4 - - Check for absence of files characterizing container filesystems. - - - - - - - - - Kerberos server is older than 1.17-18 - - Red Hat Enterprise Linux CoreOS 4 - - - Check if version of Kerberos server is lesser than 1.17-18 - - - - - - - - - Kerberos workstation is older than 1.17-18 - - Red Hat Enterprise Linux CoreOS 4 - - - Check if version of Kerberos workstation is lesser than 1.17-18 - - - - - - - - - Test that the architecture is aarch64 - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64 - - - - - - - - Test for different architecture than aarch64 - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64 - - - - - - - - Test for different architecture than s390x - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x - - - - - - - - Test that the architecture is ppc64le - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is ppc64le - - - - - - - - Test that the architecture is s390x - - Red Hat Enterprise Linux CoreOS 4 - - Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x - - - - - - - - SSSD is configured to use LDAP - - Red Hat Enterprise Linux CoreOS 4 - - Identification provider is not set to ad within /etc/sssd/sssd.conf - - - - - - - - - Non-UEFI system boot mode check - - Red Hat Enterprise Linux CoreOS 4 - - Check if System boot mode is non-UEFI. - - - - - - - - - UEFI system boot mode check - - Red Hat Enterprise Linux CoreOS 4 - - Check if system boot mode is UEFI. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - alinux-release - - - alinux-release - - - centos-release - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)"$ - 1 - - - /etc/debian_version - - - /etc/debian_version - ^10.[0-9]+$ - 1 - - - /etc/debian_version - ^11.[0-9]+$ - 1 - - - /etc/debian_version - ^9.[0-9]+$ - 1 - - - fedora-release.* - - - /etc/system-release-cpe - ^cpe:\/o:fedoraproject:fedora:[\d]+$ - 1 - - - oraclelinux-release - - - oraclelinux-release - - - oraclelinux-release - - - openSUSE-release - - - openSUSE-release - - - openSUSE-release - - - - /etc/os-release - ^ID="(\w+)"$ - 1 - - - /etc/os-release - ^VERSION_ID="(\d)\.\d+"$ - 1 - - - - redhat-release-client - - - redhat-release-workstation - - - redhat-release-server - - - redhat-release-computenode - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - - redhat-release - - - /etc/redhat-release - ^Red Hat Enterprise Linux release (\d)\.\d+$ - 1 - - - redhat-release-virtualization-host - - - sl-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - - sled-release - - - sles-release - - - SLES_SAP-release - - - /etc/lsb-release - - - /etc/lsb-release - ^DISTRIB_ID=Ubuntu$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=xenial$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=bionic$ - 1 - - - /etc/lsb-release - ^DISTRIB_CODENAME=focal$ - 1 - - - uos-release - - - rhvm-appliance - - - audit - - - chrony - - - gdm - - - grub2-common - - - /sys/firmware/opal - - - libuser - - - shadow-utils - - - net-snmp - - - nss-pam-ldapd - - - ntp - - - ovirt-host - - - ovirt-engine - - - pam - - - polkit - - - postfix - - - sssd-common - - - sudo - - - systemd - - - tftp-server - - - tmux - - - usbguard - - - /proc/net/wireless - - - yum - - - s390utils-base - - - /.dockerenv - - - /run/.containerenv - - - krb5-server - - - krb5-workstation - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /proc/sys/kernel/osrelease - ^.*\.(.*)$ - 1 - - - /etc/sssd/sssd.conf - ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$ - 1 - - - /sys/firmware/efi - - - - - - - ^2.*$ - - - ^3.*$ - - - ^7.*$ - - - centos - - - 8 - - - centos - - - 9 - - - ^7.*$ - - - ^8.*$ - - - ^9.*$ - - - openSUSE-release - - - ^15.*$ - - - ^42.*$ - - - unix - - - rhcos - - - 4 - - - unix - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - ^7.*$ - - - 7 - - - unix - - - ^8.*$ - - - ^8.0*$ - - - ^8.1*$ - - - ^8.2*$ - - - ^8.3*$ - - - ^8.4*$ - - - ^8.5*$ - - - ^8.6*$ - - - ^8.7*$ - - - ^8.8*$ - - - ^8.9*$ - - - ^8.10*$ - - - 8 - - - unix - - - ^9.*$ - - - 9 - - - 0:4.4 - - - ^7.*$ - - - unix - - - ^12.*$ - - - ^12.*$ - - - ^12.*$ - - - unix - - - ^15.*$ - - - ^15.*$ - - - ^15.*$ - - - ^20.*$ - - - ^4.*$ - - - 0:1.17-18 - - - 0:1.17-18 - - - ^aarch64$ - - - ^ppc64le$ - - - ^s390x$ - - - ppc64le - - - - -