~/f/scap-security-guide/RPMS.2017 ~/f/scap-security-guide ~/f/scap-security-guide RPMS.2017/scap-security-guide-0.1.68-0.0.noarch.rpm RPMS/scap-security-guide-0.1.68-0.0.noarch.rpm differ: byte 225, line 1 Comparing scap-security-guide-0.1.68-0.0.noarch.rpm to scap-security-guide-0.1.68-0.0.noarch.rpm comparing the rpm tags of scap-security-guide --- old-rpm-tags +++ new-rpm-tags @@ -247,9 +247,9 @@ -/usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html 146a18f74f7bb2e7707f729b6061ab25e37b8d01a703bd118f741c2e958cadc5 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html 9d9811e9b054cbeb2e676a9510f8b44449a7e5a3ce6ac7ad2afd6855e5d2ea11 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html 3c1c668a0ddf08280cbeeb44eb3dc2a548078f910f300d7687acdd2414e45de7 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html 21c5d86728566d9aeca45a70d91534089bb0e934a0afe9d07eb8e95181523183 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html bd374effa8cbe5d981cd9905d9b5529da445a5a3154a479c6998ca400dd61cf6 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html c7346e9518c833157657a9d33e396b45806a7080a209baf6ae4ba0120d2cb723 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html b8fa93740556da019e20a798d0c0951023cf3f923a2e7b799acb6e1af8c95086 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html fa43900c0746a4710002a7f0ce332e743c24f182f68bd639114c7c4b0ed8cc7e 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html 818b68d3ebc5cb4d3fdd7dee1ef7ba52364323214a6c7209c1737b8fa5b9f408 2 +/usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html 2a3d2700b03408a87062715b6b14fe026f8cb158aff3c3016c2e1a6b5ba24796 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html 26d157dbe2e001201ac93147e3e83574bc3c4a4000861c888852cdae501509dd 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html 1a89c37183834f91364cb8e597bc883b6995621ea862ab4fa4c4bb17e5c5351e 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html 074236fcf0866ea4f19789cca5772f98f35cdb0026b93febc4becdf4afe0263b 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html 0cc6d3e71a3493fad87f5f8a04b43aebdfb56e33716b05508ee5aa31c6e5b64b 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html abc84bb3f69e892dc3213ff13104a409c2977d9734eb89de9b351e3c13e02abd 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html 7c536da0f9d622334fbeb1d5105bf68d59b96df88f04bc25fa1827fba6caf87f 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html f0490f57ee259741324d9f5887f9a6b11f0bed46e168f0bdac4dd0a25b713a06 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html 73fd44b40367c3097b5ca5c635d59059a2f815f2258661b7be8f5426355c47a0 2 @@ -257,13 +257,13 @@ -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss-4.html bbab632e02de15818b89db0236463eba489a9440235d8cd99dfe17cc708f6631 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss.html 9869c5677aaaca37e6444c8821e41f0073bc32a919f2006cf77f47735f25bd23 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html 4f282ea778f825acaf206571cbe05f4c3bd69ed00144621d56444bed298701a7 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html 2df5f21f8e63df3c2532e5867887cd03a9b613d83116524b2739ba8e831876cf 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html d64ddd72bef41903b239c11463f6c0795a0deeb65a4c49fefd64ea2cf77be682 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html 2a74a5796d0c2824fb76f94ec674eb497fd0cf35fc78bb585d0ab632425719d8 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html f3041c214e1b792fd9340497363fd66be2d201c8ec09f13573df442cfe2cb164 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html 6ea25d2a6ae135f4bf708fec648eaf7d66cba056d989d63d03ba306b035b0a50 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html e2537789411baa1e53cada6ddd4884c220f39665457f7be41bc936f6cc84d64c 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html 8fa22e97d88a156d811d577b1a274057509cceb1b3ad5795fcb5343baaf213b5 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html 889f9d1e06133d51805e5aa98b5f7d02db54ff47d0c5a0cde25d6201e4cc6a4a 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html d1d78e272c1e24a6231fbbac5339e6f730278faaefa780686cb707b00d038993 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html e6886e8b71efdf35ec30d23f07f6147ab421d4ad235d505c432124dff509095d 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss-4.html 8143626c078c209804a9324f93f57c20d5d8ebe8beb5c221916aa81cd71e68de 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss.html ff04db24c97f6784c0ec01b3fd2ee22ee4f9e2a185a14e270f5aefad6d248bcf 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html 439bd1e9cd0485cca6409181e38a8a77b4d789b79e14c3713cdb81d4b591b2c4 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html 80bbeb496907e17a11bef69aba606d3a180735b78422fe6277f2ed32ad1bd719 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html bec5c8a5958c73c4b241756cd36269076af696a35b17c3d0ff6b18a9253827ed 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html 13f3eb9e598a378d4b21d08ccc7f236cb00bd71a22b758d40b6e0aa3a70dcb6e 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html 98e8249585dc4e4a727a66d5b8e9a666248e844fd2f9de37e5ad5906fcd6673f 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html ba890ea4e78ab26711eb0b13dd736d0e0dc1f6ac1d583d8b371ae6a64b28b916 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html 766f1cb254506469c9bd78062edb5cb086e23486f1b811ca69f9e0d4383bc8d3 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html 3925613a13e5a49257d4ae63ae4f7da8a3ff5e85854f4fbba3a9a67e69e41c7f 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html c887833e0c3749dc793c3a519c201421de3c25d1341fb0daff312784aead0f30 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html a229a0be71d54eb2a4a25ca90ce4bcc94ab0094ca99838aca82b081aea5e7308 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html 665017abaf6e1fac52029f6a1a9ed95c55bd67e8a25c3e1c97893c010b3470c4 2 @@ -271,6 +271,6 @@ -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss-4.html 6f2be5c302df01b8481727ae8dc5400d6a9eb9add58feb28791f887103daa55b 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html 9312e63592448614de479ce05a96bb0bb13fcd74ed8e5664572cbf4f041f0b94 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening-sap.html ff4e86c52bbf25c48f4647db810c29bf711d7ca5f03bf8a9b1d7ad428b226f7b 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html f15087c415e642422f5d34621a7bcea93f07f866260b662253ec989e3031ed4d 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html 9ae377384f911130bfb39328bd4f8973479c0daa5881d857387bcbf4afcdfb4b 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html 133d3d4bf4a776d2f7845c6b7e8604d722368fb16d25ef5187fdf874bb66fc34 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss-4.html c270eeb583ecc699e509ac1afc38c7cdbbfe43ac9edae774e07b09c8e8e697e6 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html 02196a23923514b8ddbb23a8b5c0d5d5e89da99739f18598c545a5f999ccb83e 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening-sap.html b8164ca7dc8bed256da3b2883b4350a97d6df845b514be5c0e54372f6839cb35 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html ab2915cee9bf45715e5df8296930b53e8f11242567d344ba74617233c0cb44ef 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html 48f0424a36e4784093e338eca31accb2ab9d343cfc8651a10549f7c8159035eb 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html 026009b133f36fca9e16bfe27c72bc92f96e7f029a251b93713a9ef5aa308ab4 2 @@ -352,3 +352,3 @@ -/usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml d378e7e654dd8c80b7185b7334964adbb1668b0ee81d9fbc92aacc299e96777b 0 -/usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml 0940f61ab6c0300eda97f3bacf1c5a0371660a92c414ee9a4f114ec61d3939bb 0 -/usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml fefed7b6427949bb2f331eea00394cea0258d9acb672d1cd6dbeabb5917e6316 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml 2862f713564945016c16daaf4b5350544b84721ea66ce656cf404e9726f434b8 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml 2d0e97eec51cb904e92aec040d7a888c22de398735094937c6be7ea410481849 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml 7f11aa7bb12b9abb6c0f40b7ecb3ebf5f6a28fbe95ba9ae3ba87a8a7ac0f4718 0 @@ -356 +356 @@ -/usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml 9660fc00f57cbe192c3c94033f6b178f2d7ede88faf0c0c09d26dbff937be439 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml ea8a5ac674f5a0fa5379368ad5854c019f60433077e16d4fb9c0ddd1ff49df1c 0 @@ -359,3 +359,3 @@ -/usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml 25795d5632fa91f187cd64a609093ea4e933ab123c39d629a5f786ffcffd8b18 0 -/usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml 3109a382d9c5f5bf82cc4981f1c9b781863a416518bd86c47cde26166b5e9b30 0 -/usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml 6af0334d51b6923e837bb0d3784475b40bea0630e04b1cca36c4925648ba0249 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml b135d90fea43ebabd2e1bef0ad277859a05b29794feb74ff887dfd9c38150141 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml 2e774f3e3b0909dbe5bb6a9d129747706579c30c548af941831e581086a602db 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml 931ef5750aa404b2f3609eeb63a51ab1222a1c20559056f09b316db536dd923e 0 @@ -363 +363 @@ -/usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml 5cab62b53229e7b5d3d6926764badef46111426e71cff21f80b84d61981ae215 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml 6a690c04b069da5173c0b42cd7d0e6dd6c8e3dfe91c0ab43245a27a8638a138f 0 @@ -366,3 +366,3 @@ -/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml 8f857120586e7d083f665eee87728ca835873bc44a5ee774feace96b77b3a0a6 0 -/usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml 884af1f5442418885e56b4554b57930e7b9d66e105f99c251a211b63cadef3b3 0 -/usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml e277be4478838d0a29c37dc9bc570c561ae1bd31efc046d660ac00cab3eb827c 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml fa34c5a5c0a7bbb1ab197a8498cce817d90c659c504790e16bd99d73f3c2db34 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml d14b00017e4b75a8e94cf3ec42a226aa0fd9c996d056fc8826c424809524180d 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml be59e851316e4d68c62b0cbb81848ae9333840215d58e847182cd790df4d051d 0 @@ -370 +370 @@ -/usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml 88e8eaf62197f33fced72858043c2851b9cd8aed26c6d03d8ba11e2709e76882 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml 9a6a5b7c4be6d50cb7d8e6c3019970b22ca49f4df27fdce86593129cc1afbe26 0 comparing rpmtags comparing RELEASE comparing PROVIDES comparing scripts comparing filelist comparing file checksum creating rename script RPM file checksum differs. Extracting packages /usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html 2023-06-15 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html 2023-06-15 00:00:00.000000000 +0000 @@ -67,7 +67,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for openSUSE
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:opensuse:leap:15.0
  • cpe:/o:opensuse:leap:42.1
  • cpe:/o:opensuse:leap:42.2
  • cpe:/o:opensuse:leap:42.3

Revision History

Current version: 0.1.68

Table of Contents

  1. System Settings
    1. File Permissions and Masks

Checklist

Group   Guide to the Secure Configuration of openSUSE   Group contains 4 groups and 3 rules
Group   @@ -113,7 +113,8 @@ Verify Group Who Owns passwd File   [ref]
To properly set the group owner of /etc/passwd, run the command: 
$ sudo chgrp root /etc/passwd
Rationale:
The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
Identifiers and References

References:  - 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, 7.2.6, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:low
Strategy:configure
chgrp 0 /etc/passwd
+

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
   stat:
     path: /etc/passwd
   register: file_exists
@@ -147,12 +148,12 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-

Complexity:low
Disruption:low
Strategy:configure
chgrp 0 /etc/passwd

Rule   Verify User Who Owns passwd File   [ref]

To properly set the owner of /etc/passwd, run the command: 
$ sudo chown root /etc/passwd
Rationale:
The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
Identifiers and References

References:  - 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, 7.2.6, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:low
Strategy:configure
chown 0 /etc/passwd
+

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
   stat:
     path: /etc/passwd
   register: file_exists
@@ -186,7 +187,6 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-

Complexity:low
Disruption:low
Strategy:configure
chown 0 /etc/passwd

Rule   Verify Permissions on passwd File   [ref]

@@ -195,7 +195,13 @@ world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd
Identifiers and References

References:  - BP28(R36), 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, 7.2.6, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:low
Strategy:configure

+
+
+
+
+chmod u-xs,g-xws,o-xwt /etc/passwd
+

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
   stat:
     path: /etc/passwd
   register: file_exists
@@ -229,12 +235,6 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-

Complexity:low
Disruption:low
Strategy:configure

-
-
-
-
-chmod u-xs,g-xws,o-xwt /etc/passwd
Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their /usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html 2023-06-15 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html 2023-06-15 00:00:00.000000000 +0000 @@ -77,7 +77,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12

Revision History

Current version: 0.1.68

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 67 groups and 227 rules
Group   @@ -122,7 +122,15 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1



Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -140,25 +148,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"

Rule   Build and Test AIDE Database   [ref]

Run the following command to generate a new database: @@ -181,7 +181,18 @@ If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References

Identifiers:  CCE-91483-8

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1



# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,17 +272,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
Group   Disk Partitioning   Group contains 10 rules
[ref]   @@ -407,7 +407,15 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installedIdentifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "sudo"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
     state: present
@@ -422,25 +430,17 @@
   - medium_severity
   - no_reboot_needed
   - package_sudo_installed
-


-[[packages]]
-name = "sudo"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "sudo"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
 
 class install_sudo {
   package { 'sudo':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "sudo"
+version = "*"
 
Rule  
                                 Ensure sudo Runs In A Minimal Environment - sudo env_reset
                                   [ref]
The sudo env_reset tag, when specified, will run the command in a minimal environment,
@@ -450,7 +450,27 @@
 in /etc/sudoers.d/.
Rationale:
Forcing sudo to reset the environment ensures that environment variables are not passed on to the
 command accidentaly, preventing leak of potentially sensitive information.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_env_reset
Identifiers and References
Identifiers: 
             CCE-91492-9
References: 
-            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

+if /usr/sbin/visudo -qcf /etc/sudoers; then
+    cp /etc/sudoers /etc/sudoers.bak
+    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option env_reset
+        echo "Defaults env_reset" >> /etc/sudoers
+    fi
+    
+    # Check validity of sudoers and cleanup bak
+    if /usr/sbin/visudo -qcf /etc/sudoers; then
+        rm -f /etc/sudoers.bak
+    else
+        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
+        mv /etc/sudoers.bak /etc/sudoers
+        false
+    fi
+else
+    echo "Skipping remediation, /etc/sudoers failed to validate"
+    false
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
   lineinfile:
     path: /etc/sudoers
     regexp: ^[\s]*Defaults.*\benv_reset\b.*$
@@ -464,12 +484,21 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_add_env_reset
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot
+                                  [ref]
The sudo ignore_dot tag, when specified, will ignore the current directory
+in the PATH environment variable.
+This should be enabled by making sure that the ignore_dot tag exists in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Ignoring the commands in the user's current directory prevents an attacker from executing commands
+downloaded locally.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_ignore_dot
Identifiers and References
Identifiers: 
+            CCE-91493-7
References: 
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

 if /usr/sbin/visudo -qcf /etc/sudoers; then
     cp /etc/sudoers /etc/sudoers.bak
-    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
-        # sudoers file doesn't define Option env_reset
-        echo "Defaults env_reset" >> /etc/sudoers
+    if ! grep -P '^[\s]*Defaults[\s]*\bignore_dot\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option ignore_dot
+        echo "Defaults ignore_dot" >> /etc/sudoers
     fi
     
     # Check validity of sudoers and cleanup bak
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html	2023-06-15 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Kernel Configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
    9. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 68 groups and 280 rules
Group  
@@ -122,7 +122,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -140,25 +148,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -181,7 +181,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,17 +272,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -295,7 +295,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-91529-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-12-010500, 1.4.2, SV-217148r603262_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -407,22 +423,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Notification of Post-AIDE Scan Details
                                   [ref]
AIDE should notify appropriate personnel of the details of a scan after the scan has been run.
@@ -442,7 +442,34 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_scan_notification
Identifiers and References
Identifiers: 
             CCE-83048-9
References: 
-            BP28(R51), 1, 11, 12, 13, 15, 16, 2, 3, 5, 7, 8, 9, BAI01.06, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, SR 6.2, SR 7.6, A.12.1.2, A.12.4.1, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, SI-6d, DE.CM-1, DE.CM-7, PR.IP-1, PR.IP-3, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-12-010510, SV-217149r603262_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+var_aide_scan_notification_email='root@localhost'
+
+
+CRONTAB=/etc/crontab
+CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
+
+# NOTE: on some platforms, /etc/crontab may not exist
+if [ -f /etc/crontab ]; then
+	CRONTAB_EXIST=/etc/crontab
+fi
+
+if [ -f /var/spool/cron/root ]; then
+	VARSPOOL=/var/spool/cron/root
+fi
+
+if ! grep -qR '^.*/usr/bin/aide\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*.*@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
+	echo "0 5 * * * root /usr/bin/aide  --check | /bin/mail -s \"\$(hostname) - AIDE Integrity Check\" $var_aide_scan_notification_email" >> $CRONTAB
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_aide_scan_notification_email # promote to variable
   set_fact:
     var_aide_scan_notification_email: !!str root@localhost
   tags:
@@ -486,33 +513,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-var_aide_scan_notification_email='root@localhost'
-
-
-CRONTAB=/etc/crontab
-CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
-
-# NOTE: on some platforms, /etc/crontab may not exist
-if [ -f /etc/crontab ]; then
-	CRONTAB_EXIST=/etc/crontab
-fi
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html	2023-06-15 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services
    4. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 54 groups and 155 rules
Group  
@@ -122,7 +122,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -140,25 +148,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -181,7 +181,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,17 +272,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 9 rules
[ref]  
@@ -394,7 +394,15 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References
Identifiers: 
             CCE-91491-1
References: 
-            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "sudo"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
     state: present
@@ -409,25 +417,17 @@
   - medium_severity
   - no_reboot_needed
   - package_sudo_installed
-


-[[packages]]
-name = "sudo"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "sudo"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
 
 class install_sudo {
   package { 'sudo':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "sudo"
+version = "*"
 
Rule  
                                 Ensure sudo Runs In A Minimal Environment - sudo env_reset
                                   [ref]
The sudo env_reset tag, when specified, will run the command in a minimal environment,
@@ -437,7 +437,27 @@
 in /etc/sudoers.d/.
Rationale:
Forcing sudo to reset the environment ensures that environment variables are not passed on to the
 command accidentaly, preventing leak of potentially sensitive information.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_env_reset
Identifiers and References
Identifiers: 
             CCE-91492-9
References: 
-            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

+if /usr/sbin/visudo -qcf /etc/sudoers; then
+    cp /etc/sudoers /etc/sudoers.bak
+    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option env_reset
+        echo "Defaults env_reset" >> /etc/sudoers
+    fi
+    
+    # Check validity of sudoers and cleanup bak
+    if /usr/sbin/visudo -qcf /etc/sudoers; then
+        rm -f /etc/sudoers.bak
+    else
+        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
+        mv /etc/sudoers.bak /etc/sudoers
+        false
+    fi
+else
+    echo "Skipping remediation, /etc/sudoers failed to validate"
+    false
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
   lineinfile:
     path: /etc/sudoers
     regexp: ^[\s]*Defaults.*\benv_reset\b.*$
@@ -451,12 +471,21 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_add_env_reset
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot
+                                  [ref]
The sudo ignore_dot tag, when specified, will ignore the current directory
+in the PATH environment variable.
+This should be enabled by making sure that the ignore_dot tag exists in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Ignoring the commands in the user's current directory prevents an attacker from executing commands
+downloaded locally.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_ignore_dot
Identifiers and References
Identifiers: 
+            CCE-91493-7
References: 
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

 if /usr/sbin/visudo -qcf /etc/sudoers; then
     cp /etc/sudoers /etc/sudoers.bak
-    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
-        # sudoers file doesn't define Option env_reset
-        echo "Defaults env_reset" >> /etc/sudoers
+    if ! grep -P '^[\s]*Defaults[\s]*\bignore_dot\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option ignore_dot
+        echo "Defaults ignore_dot" >> /etc/sudoers
     fi
     
     # Check validity of sudoers and cleanup bak
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html	2023-06-15 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 26 groups and 42 rules
Group  
@@ -109,7 +109,22 @@
 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
Identifiers: 
             CCE-83013-3
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, SLES-12-010110, SV-217112r646686_rule


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -146,21 +161,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Rule  
                                 Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
                                   [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
@@ -173,7 +173,22 @@
 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
Identifiers: 
             CCE-83012-5
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, SLES-12-010110, SV-217112r646686_rule


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "NOPASSWD" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -210,21 +225,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 Updating Software
                           Group contains 8 rules
[ref]  
@@ -244,7 +244,9 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI)
 to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References
Identifiers: 
             CCE-91476-2
References: 
-            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
     state: present
@@ -256,19 +258,17 @@
   - medium_severity
   - no_reboot_needed
   - package_dnf-automatic_installed
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
 
Rule  
                                 Configure dnf-automatic to Install Available Updates Automatically
                                   [ref]
To ensure that the packages comprising the available updates will be automatically installed by dnf-automatic, set apply_updates to yes under [commands] section in /etc/dnf/automatic.conf.
Rationale:
Installing software updates is a fundamental mitigation against
@@ -279,25 +279,7 @@
 The automated installation of updates ensures that recent security patches
 are applied in a timely manner.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates
Identifiers and References
Identifiers: 
             CCE-91474-7
References: 
-            BP28(R8), 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, SI-2(5), CM-6(a), SI-2(c), FMT_SMF_EXT.1, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:medium
- name: Configure dnf-automatic to Install Available Updates Automatically
-  ini_file:
-    dest: /etc/dnf/automatic.conf
-    section: commands
-    option: apply_updates
-    value: 'yes'
-    create: true
-  tags:
-  - CCE-91474-7
-  - NIST-800-53-CM-6(a)
-  - NIST-800-53-SI-2(5)
-  - NIST-800-53-SI-2(c)
-  - dnf-automatic_apply_updates
-  - low_complexity
-  - medium_disruption
-  - medium_severity
-  - no_reboot_needed
-  - unknown_strategy
-



 found=false
 
 # set value in all files if they contain section or key
@@ -324,33 +306,33 @@
     mkdir -p "$(dirname "$file")"
     echo -e "[commands]\napply_updates = yes" >> "$file"
 fi
-
Rule  
-                                Configure dnf-automatic to Install Only Security Updates
-                                  [ref]
To configure dnf-automatic to install only security updates
-automatically, set upgrade_type to security under
-[commands] section in /etc/dnf/automatic.conf.
Rationale:
By default, dnf-automatic installs all available updates.
-Reducing the amount of updated packages only to updates that were
-issued as a part of a security advisory increases the system stability.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only
Identifiers and References
Identifiers: 
-            CCE-91478-8
References: 
-            BP28(R8), SI-2(5), CM-6(a), SI-2(c), FMT_SMF_EXT.1, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:medium
- name: Configure dnf-automatic to Install Only Security Updates
+

Complexity:low
Disruption:medium
- name: Configure dnf-automatic to Install Available Updates Automatically
   ini_file:
     dest: /etc/dnf/automatic.conf
     section: commands
-    option: upgrade_type
-    value: security
+    option: apply_updates
+    value: 'yes'
     create: true
   tags:
-  - CCE-91478-8
+  - CCE-91474-7
   - NIST-800-53-CM-6(a)
   - NIST-800-53-SI-2(5)
   - NIST-800-53-SI-2(c)
-  - dnf-automatic_security_updates_only
+  - dnf-automatic_apply_updates
   - low_complexity
-  - low_severity
   - medium_disruption
+  - medium_severity
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 12 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Print Support
    14. Proxy Server
    15. Samba(SMB) Microsoft Windows File Sharing Server
    16. SNMP Server
    17. SSH Server
    18. X Window System
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 112 groups and 353 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-91529-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-12-010500, 1.4.2, SV-217148r603262_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -400,22 +416,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 7 rules
[ref]  
@@ -618,7 +618,69 @@
 with physical access to the system to quickly enumerate known user accounts
 without logging in.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
Identifiers and References
Identifiers: 
             CCE-92346-6
References: 
-            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:medium
- name: Gather the package facts
+            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+
+# Check for setting in any of the DConf db directories
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 12 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Print Support
    14. Proxy Server
    15. Samba(SMB) Microsoft Windows File Sharing Server
    16. SNMP Server
    17. SSH Server
    18. X Window System
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 100 groups and 283 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-91529-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-12-010500, 1.4.2, SV-217148r603262_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -400,22 +416,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 2 rules
[ref]  
@@ -568,7 +568,69 @@
 with physical access to the system to quickly enumerate known user accounts
 without logging in.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
Identifiers and References
Identifiers: 
             CCE-92346-6
References: 
-            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:medium
- name: Gather the package facts
+            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+
+# Check for setting in any of the DConf db directories
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 12 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. DHCP
    3. DNS Server
    4. FTP Server
    5. Web Server
    6. IMAP and POP3 Server
    7. LDAP
    8. Mail Server Software
    9. NFS and RPC
    10. Network Time Protocol
    11. Obsolete Services
    12. Proxy Server
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 93 groups and 274 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-91529-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-12-010500, 1.4.2, SV-217148r603262_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -400,22 +416,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 2 rules
[ref]  
@@ -568,7 +568,69 @@
 with physical access to the system to quickly enumerate known user accounts
 without logging in.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
Identifiers and References
Identifiers: 
             CCE-92346-6
References: 
-            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:medium
- name: Gather the package facts
+            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+
+# Check for setting in any of the DConf db directories
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 12 Benchmark Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 109 groups and 349 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-91529-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-12-010500, 1.4.2, SV-217148r603262_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -400,22 +416,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 7 rules
[ref]  
@@ -618,7 +618,69 @@
 with physical access to the system to quickly enumerate known user accounts
 without logging in.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
Identifiers and References
Identifiers: 
             CCE-92346-6
References: 
-            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:medium
- name: Gather the package facts
+            CM-6(a), AC-23, SRG-OS-000480-GPOS-00227, 1.10

# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+
+# Check for setting in any of the DConf db directories
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss-4.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss-4.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss-4.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitlePCI-DSS v4 Control Baseline for SUSE Linux enterprise 12
Profile IDxccdf_org.ssgproject.content_profile_pci-dss-4
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. Web Server
    6. LDAP
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Print Support
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. System Security Services Daemon
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 88 groups and 213 rules
Group  
@@ -133,7 +133,16 @@
 information given by the RPM database. Executables with erroneous hashes could
 be a sign of nefarious activity on the system.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_hashes
Identifiers and References
Identifiers: 
             CCE-91632-0
References: 
-            11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.3.8, 3.4.1, CCI-000366, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), PR.DS-6, PR.DS-8, PR.IP-1, Req-11.5, 11.5.2, SRG-OS-000480-GPOS-00227



+# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
+files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
+
+# From files names get package names and change newline to space, because rpm writes each package to new line
+packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
+
+
+zypper install -f -y $packages_to_reinstall
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: 'Set fact: Package manager reinstall command (dnf)'
   set_fact:
     package_manager_reinstall_cmd: dnf reinstall -y
   when: ansible_distribution == "Fedora"
@@ -292,15 +301,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_hashes
-


-# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
-files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
-
-# From files names get package names and change newline to space, because rpm writes each package to new line
-packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
-
-
-zypper install -f -y $packages_to_reinstall
 
Rule  
                                 Verify and Correct Ownership with RPM
                                   [ref]
The RPM package management system can check file ownership
@@ -346,7 +346,32 @@
 The permissions set by the vendor should be maintained. Any deviations from
 this baseline should be investigated.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_permissions
Identifiers and References
Identifiers: 
             CCE-91634-6
References: 
-            1, 11, 12, 13, 14, 15, 16, 18, 3, 5, 6, 9, 5.10.4.1, APO01.06, APO11.04, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.8, 3.4.1, CCI-001493, CCI-001494, CCI-001495, CCI-001496, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4.2, CIP-003-8 R6, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), CM-6(a), PR.AC-4, PR.DS-5, PR.IP-1, PR.PT-1, Req-11.5, 11.5.2, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108, 6.1.1


Complexity:high
Disruption:medium
Strategy:restrict

+# Declare array to hold set of RPM packages we need to correct permissions for
+declare -A SETPERMS_RPM_DICT
+
+# Create a list of files on the system having permissions different from what
+# is expected by the RPM database
+readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
+
+for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
+do
+        # NOTE: some files maybe controlled by more then one package
+        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
+        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
+        do
+                # Use an associative array to store packages as it's keys, not having to care about duplicates.
+                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
+        done
+done
+
+# For each of the RPM packages left in the list -- reset its permissions to the
+# correct values
+for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
+do
+	rpm --restore "${RPM_PACKAGE}"
+done
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: Read list of files with incorrect permissions
   command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
     --nocaps --nolinkto --nouser --nogroup
   register: files_with_incorrect_permissions
@@ -429,31 +454,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_permissions
-

Complexity:high
Disruption:medium
Strategy:restrict

-# Declare array to hold set of RPM packages we need to correct permissions for
-declare -A SETPERMS_RPM_DICT
-
-# Create a list of files on the system having permissions different from what
-# is expected by the RPM database
-readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
-
-for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
-do
-        # NOTE: some files maybe controlled by more then one package
-        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
-        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
-        do
-                # Use an associative array to store packages as it's keys, not having to care about duplicates.
-                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
-        done
-done
-
-# For each of the RPM packages left in the list -- reset its permissions to the
-# correct values
-for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
-do
-	rpm --restore "${RPM_PACKAGE}"
-done
 
Group  
                 Verify Integrity with AIDE
                           Group contains 3 rules
[ref]  
@@ -467,7 +467,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -485,25 +493,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -526,7 +526,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -606,17 +617,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -640,7 +640,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-pci-dss.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitlePCI-DSS v3.2.1 Control Baseline for SUSE Linux enterprise 12
Profile IDxccdf_org.ssgproject.content_profile_pci-dss
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 61 groups and 154 rules
Group  
@@ -133,7 +133,16 @@
 information given by the RPM database. Executables with erroneous hashes could
 be a sign of nefarious activity on the system.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_hashes
Identifiers and References
Identifiers: 
             CCE-91632-0
References: 
-            11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.3.8, 3.4.1, CCI-000366, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), PR.DS-6, PR.DS-8, PR.IP-1, Req-11.5, 11.5.2, SRG-OS-000480-GPOS-00227



+# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
+files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
+
+# From files names get package names and change newline to space, because rpm writes each package to new line
+packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
+
+
+zypper install -f -y $packages_to_reinstall
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: 'Set fact: Package manager reinstall command (dnf)'
   set_fact:
     package_manager_reinstall_cmd: dnf reinstall -y
   when: ansible_distribution == "Fedora"
@@ -292,15 +301,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_hashes
-


-# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
-files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
-
-# From files names get package names and change newline to space, because rpm writes each package to new line
-packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
-
-
-zypper install -f -y $packages_to_reinstall
 
Rule  
                                 Verify and Correct Ownership with RPM
                                   [ref]
The RPM package management system can check file ownership
@@ -346,7 +346,32 @@
 The permissions set by the vendor should be maintained. Any deviations from
 this baseline should be investigated.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_permissions
Identifiers and References
Identifiers: 
             CCE-91634-6
References: 
-            1, 11, 12, 13, 14, 15, 16, 18, 3, 5, 6, 9, 5.10.4.1, APO01.06, APO11.04, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.8, 3.4.1, CCI-001493, CCI-001494, CCI-001495, CCI-001496, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4.2, CIP-003-8 R6, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), CM-6(a), PR.AC-4, PR.DS-5, PR.IP-1, PR.PT-1, Req-11.5, 11.5.2, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108, 6.1.1


Complexity:high
Disruption:medium
Strategy:restrict

+# Declare array to hold set of RPM packages we need to correct permissions for
+declare -A SETPERMS_RPM_DICT
+
+# Create a list of files on the system having permissions different from what
+# is expected by the RPM database
+readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
+
+for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
+do
+        # NOTE: some files maybe controlled by more then one package
+        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
+        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
+        do
+                # Use an associative array to store packages as it's keys, not having to care about duplicates.
+                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
+        done
+done
+
+# For each of the RPM packages left in the list -- reset its permissions to the
+# correct values
+for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
+do
+	rpm --restore "${RPM_PACKAGE}"
+done
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: Read list of files with incorrect permissions
   command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
     --nocaps --nolinkto --nouser --nogroup
   register: files_with_incorrect_permissions
@@ -429,31 +454,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_permissions
-

Complexity:high
Disruption:medium
Strategy:restrict

-# Declare array to hold set of RPM packages we need to correct permissions for
-declare -A SETPERMS_RPM_DICT
-
-# Create a list of files on the system having permissions different from what
-# is expected by the RPM database
-readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
-
-for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
-do
-        # NOTE: some files maybe controlled by more then one package
-        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
-        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
-        do
-                # Use an associative array to store packages as it's keys, not having to care about duplicates.
-                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
-        done
-done
-
-# For each of the RPM packages left in the list -- reset its permissions to the
-# correct values
-for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
-do
-	rpm --restore "${RPM_PACKAGE}"
-done
 
Group  
                 Verify Integrity with AIDE
                           Group contains 3 rules
[ref]  
@@ -467,7 +467,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -485,25 +493,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -526,7 +526,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -606,17 +617,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -640,7 +640,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleStandard System Security Profile for SUSE Linux Enterprise 12
Profile IDxccdf_org.ssgproject.content_profile_standard
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. File Permissions and Masks
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 4 groups and 3 rules
Group  
@@ -114,7 +114,8 @@
                                   [ref]
 To properly set the group owner of /etc/passwd, run the command: 
$ sudo chgrp root /etc/passwd
Rationale:
The /etc/passwd file contains information about the users that are configured on
 the system. Protection of this file is critical for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
Identifiers and References
Identifiers: 
             CCE-91627-0
References: 
-            12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, 7.2.6, SRG-OS-000480-GPOS-00227, 6.1.2


Complexity:low
Disruption:low
Strategy:configure
chgrp 0 /etc/passwd
+

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
   stat:
     path: /etc/passwd
   register: file_exists
@@ -150,13 +151,13 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-

Complexity:low
Disruption:low
Strategy:configure
chgrp 0 /etc/passwd
 
Rule  
                                 Verify User Who Owns passwd File
                                   [ref]
 To properly set the owner of /etc/passwd, run the command: 
$ sudo chown root /etc/passwd 
Rationale:
The /etc/passwd file contains information about the users that are configured on
 the system. Protection of this file is critical for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
Identifiers and References
Identifiers: 
             CCE-91666-8
References: 
-            12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, 7.2.6, SRG-OS-000480-GPOS-00227, 6.1.2


Complexity:low
Disruption:low
Strategy:configure
chown 0 /etc/passwd
+

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
   stat:
     path: /etc/passwd
   register: file_exists
@@ -192,7 +193,6 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-

Complexity:low
Disruption:low
Strategy:configure
chown 0 /etc/passwd
 
Rule  
                                 Verify Permissions on passwd File
                                   [ref]

@@ -202,7 +202,13 @@
 accounts on the system and associated information, and protection of this file
 is critical for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd
Identifiers and References
Identifiers: 
             CCE-91452-3
References: 
-            BP28(R36), 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, 7.2.6, SRG-OS-000480-GPOS-00227, 6.1.2


Complexity:low
Disruption:low
Strategy:configure

+
+
+
+
+chmod u-xs,g-xws,o-xwt /etc/passwd
+

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
   stat:
     path: /etc/passwd
   register: file_exists
@@ -238,12 +244,6 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-

Complexity:low
Disruption:low
Strategy:configure

-
-
-
-
-chmod u-xs,g-xws,o-xwt /etc/passwd
 
Red Hat and Red Hat Enterprise Linux are either registered
 trademarks or trademarks of Red Hat, Inc. in the United States and other
 countries. All other names are registered trademarks or trademarks of their
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html	2023-06-15 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleDISA STIG for SUSE Linux Enterprise 12
Profile IDxccdf_org.ssgproject.content_profile_stig
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:12
  • cpe:/o:suse:linux_enterprise_server:12
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Base Services
    2. FTP Server
    3. Mail Server Software
    4. NFS and RPC
    5. Network Time Protocol
    6. Obsolete Services
    7. SSH Server
    8. System Security Services Daemon
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 12
                           Group contains 83 groups and 241 rules
Group  
@@ -111,7 +111,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83067-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -129,25 +137,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -170,7 +170,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-91483-8
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-12-010499, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -250,17 +261,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure AIDE to Verify the Audit Tools
                                   [ref]
The operating system file integrity tool must be configured to protect the integrity of the audit tools.
Rationale:
Protecting the integrity of the tools used for auditing purposes is a
@@ -283,7 +283,66 @@
 manipulated, or replaced. An example is a checksum hash of the file or
 files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_check_audit_tools
Identifiers and References
Identifiers: 
             CCE-83204-8
References: 
-            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-12-010540, SV-217152r603262_rule

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
+            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-12-010540, SV-217152r603262_rule

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+
+
+
+
+
+
+
+
+
+if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/augenrules.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/audispd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
   package:
     name: '{{ item }}'
     state: present
@@ -361,65 +420,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-
-
-
-
-
-
-
-
-
-if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html	2023-06-15 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 67 groups and 228 rules
Group  
@@ -122,7 +122,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -140,25 +148,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -181,7 +181,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,17 +272,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 10 rules
[ref]  
@@ -407,7 +407,15 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References
Identifiers: 
             CCE-91183-4
References: 
-            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "sudo"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
     state: present
@@ -422,25 +430,17 @@
   - medium_severity
   - no_reboot_needed
   - package_sudo_installed
-


-[[packages]]
-name = "sudo"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "sudo"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
 
 class install_sudo {
   package { 'sudo':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "sudo"
+version = "*"
 
Rule  
                                 Ensure sudo Runs In A Minimal Environment - sudo env_reset
                                   [ref]
The sudo env_reset tag, when specified, will run the command in a minimal environment,
@@ -450,7 +450,27 @@
 in /etc/sudoers.d/.
Rationale:
Forcing sudo to reset the environment ensures that environment variables are not passed on to the
 command accidentaly, preventing leak of potentially sensitive information.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_env_reset
Identifiers and References
Identifiers: 
             CCE-91184-2
References: 
-            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

+if /usr/sbin/visudo -qcf /etc/sudoers; then
+    cp /etc/sudoers /etc/sudoers.bak
+    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option env_reset
+        echo "Defaults env_reset" >> /etc/sudoers
+    fi
+    
+    # Check validity of sudoers and cleanup bak
+    if /usr/sbin/visudo -qcf /etc/sudoers; then
+        rm -f /etc/sudoers.bak
+    else
+        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
+        mv /etc/sudoers.bak /etc/sudoers
+        false
+    fi
+else
+    echo "Skipping remediation, /etc/sudoers failed to validate"
+    false
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
   lineinfile:
     path: /etc/sudoers
     regexp: ^[\s]*Defaults.*\benv_reset\b.*$
@@ -464,12 +484,21 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_add_env_reset
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot
+                                  [ref]
The sudo ignore_dot tag, when specified, will ignore the current directory
+in the PATH environment variable.
+This should be enabled by making sure that the ignore_dot tag exists in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Ignoring the commands in the user's current directory prevents an attacker from executing commands
+downloaded locally.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_ignore_dot
Identifiers and References
Identifiers: 
+            CCE-91185-9
References: 
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

 if /usr/sbin/visudo -qcf /etc/sudoers; then
     cp /etc/sudoers /etc/sudoers.bak
-    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
-        # sudoers file doesn't define Option env_reset
-        echo "Defaults env_reset" >> /etc/sudoers
+    if ! grep -P '^[\s]*Defaults[\s]*\bignore_dot\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option ignore_dot
+        echo "Defaults ignore_dot" >> /etc/sudoers
     fi
     
     # Check validity of sudoers and cleanup bak
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html	2023-06-15 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Kernel Configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
    9. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 68 groups and 281 rules
Group  
@@ -122,7 +122,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -140,25 +148,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -181,7 +181,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,17 +272,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -295,7 +295,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-85671-6
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-6(d), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-15-010420, 1.4.2, SV-234851r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -397,22 +413,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Notification of Post-AIDE Scan Details
                                   [ref]
AIDE should notify appropriate personnel of the details of a scan after the scan has been run.
@@ -432,7 +432,34 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_scan_notification
Identifiers and References
Identifiers: 
             CCE-91214-7
References: 
-            BP28(R51), 1, 11, 12, 13, 15, 16, 2, 3, 5, 7, 8, 9, BAI01.06, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, SR 6.2, SR 7.6, A.12.1.2, A.12.4.1, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, CM-6(a), CM-3(5), DE.CM-1, DE.CM-7, PR.IP-1, PR.IP-3, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+var_aide_scan_notification_email='root@localhost'
+
+
+CRONTAB=/etc/crontab
+CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
+
+# NOTE: on some platforms, /etc/crontab may not exist
+if [ -f /etc/crontab ]; then
+	CRONTAB_EXIST=/etc/crontab
+fi
+
+if [ -f /var/spool/cron/root ]; then
+	VARSPOOL=/var/spool/cron/root
+fi
+
+if ! grep -qR '^.*/usr/bin/aide\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*.*@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
+	echo "0 5 * * * root /usr/bin/aide  --check | /bin/mail -s \"\$(hostname) - AIDE Integrity Check\" $var_aide_scan_notification_email" >> $CRONTAB
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_aide_scan_notification_email # promote to variable
   set_fact:
     var_aide_scan_notification_email: !!str root@localhost
   tags:
@@ -476,33 +503,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-var_aide_scan_notification_email='root@localhost'
-
-
-CRONTAB=/etc/crontab
-CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
-
-# NOTE: on some platforms, /etc/crontab may not exist
-if [ -f /etc/crontab ]; then
-	CRONTAB_EXIST=/etc/crontab
-fi
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html	2023-06-15 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services
    4. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 54 groups and 156 rules
Group  
@@ -122,7 +122,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -140,25 +148,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -181,7 +181,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,17 +272,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 9 rules
[ref]  
@@ -394,7 +394,15 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References
Identifiers: 
             CCE-91183-4
References: 
-            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, 10.2.1.5, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "sudo"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
     state: present
@@ -409,25 +417,17 @@
   - medium_severity
   - no_reboot_needed
   - package_sudo_installed
-


-[[packages]]
-name = "sudo"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "sudo"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
 
 class install_sudo {
   package { 'sudo':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "sudo"
+version = "*"
 
Rule  
                                 Ensure sudo Runs In A Minimal Environment - sudo env_reset
                                   [ref]
The sudo env_reset tag, when specified, will run the command in a minimal environment,
@@ -437,7 +437,27 @@
 in /etc/sudoers.d/.
Rationale:
Forcing sudo to reset the environment ensures that environment variables are not passed on to the
 command accidentaly, preventing leak of potentially sensitive information.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_env_reset
Identifiers and References
Identifiers: 
             CCE-91184-2
References: 
-            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

+if /usr/sbin/visudo -qcf /etc/sudoers; then
+    cp /etc/sudoers /etc/sudoers.bak
+    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option env_reset
+        echo "Defaults env_reset" >> /etc/sudoers
+    fi
+    
+    # Check validity of sudoers and cleanup bak
+    if /usr/sbin/visudo -qcf /etc/sudoers; then
+        rm -f /etc/sudoers.bak
+    else
+        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
+        mv /etc/sudoers.bak /etc/sudoers
+        false
+    fi
+else
+    echo "Skipping remediation, /etc/sudoers failed to validate"
+    false
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure env_reset is enabled in /etc/sudoers
   lineinfile:
     path: /etc/sudoers
     regexp: ^[\s]*Defaults.*\benv_reset\b.*$
@@ -451,12 +471,21 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_add_env_reset
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot
+                                  [ref]
The sudo ignore_dot tag, when specified, will ignore the current directory
+in the PATH environment variable.
+This should be enabled by making sure that the ignore_dot tag exists in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Ignoring the commands in the user's current directory prevents an attacker from executing commands
+downloaded locally.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_add_ignore_dot
Identifiers and References
Identifiers: 
+            CCE-91185-9
References: 
+            BP28(R58)

Complexity:low
Disruption:low
Strategy:restrict

 if /usr/sbin/visudo -qcf /etc/sudoers; then
     cp /etc/sudoers /etc/sudoers.bak
-    if ! grep -P '^[\s]*Defaults[\s]*\benv_reset\b.*$' /etc/sudoers; then
-        # sudoers file doesn't define Option env_reset
-        echo "Defaults env_reset" >> /etc/sudoers
+    if ! grep -P '^[\s]*Defaults[\s]*\bignore_dot\b.*$' /etc/sudoers; then
+        # sudoers file doesn't define Option ignore_dot
+        echo "Defaults ignore_dot" >> /etc/sudoers
     fi
     
     # Check validity of sudoers and cleanup bak
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html	2023-06-15 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 26 groups and 43 rules
Group  
@@ -109,7 +109,22 @@
 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
Identifiers: 
             CCE-83291-5
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, SLES-15-010450, SV-234853r622137_rule


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -146,21 +161,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Rule  
                                 Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
                                   [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
@@ -173,7 +173,22 @@
 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
Identifiers: 
             CCE-85663-3
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, SLES-15-010450, SV-234853r622137_rule


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "NOPASSWD" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -210,21 +225,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 Updating Software
                           Group contains 8 rules
[ref]  
@@ -244,7 +244,9 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI)
 to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References
Identifiers: 
             CCE-91163-6
References: 
-            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
     state: present
@@ -256,19 +258,17 @@
   - medium_severity
   - no_reboot_needed
   - package_dnf-automatic_installed
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
 
Rule  
                                 Configure dnf-automatic to Install Available Updates Automatically
                                   [ref]
To ensure that the packages comprising the available updates will be automatically installed by dnf-automatic, set apply_updates to yes under [commands] section in /etc/dnf/automatic.conf.
Rationale:
Installing software updates is a fundamental mitigation against
@@ -279,25 +279,7 @@
 The automated installation of updates ensures that recent security patches
 are applied in a timely manner.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates
Identifiers and References
Identifiers: 
             CCE-91165-1
References: 
-            BP28(R8), 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, SI-2(5), CM-6(a), SI-2(c), FMT_SMF_EXT.1, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:medium
- name: Configure dnf-automatic to Install Available Updates Automatically
-  ini_file:
-    dest: /etc/dnf/automatic.conf
-    section: commands
-    option: apply_updates
-    value: 'yes'
-    create: true
-  tags:
-  - CCE-91165-1
-  - NIST-800-53-CM-6(a)
-  - NIST-800-53-SI-2(5)
-  - NIST-800-53-SI-2(c)
-  - dnf-automatic_apply_updates
-  - low_complexity
-  - medium_disruption
-  - medium_severity
-  - no_reboot_needed
-  - unknown_strategy
-



 found=false
 
 # set value in all files if they contain section or key
@@ -324,33 +306,33 @@
     mkdir -p "$(dirname "$file")"
     echo -e "[commands]\napply_updates = yes" >> "$file"
 fi
-
Rule  
-                                Configure dnf-automatic to Install Only Security Updates
-                                  [ref]
To configure dnf-automatic to install only security updates
-automatically, set upgrade_type to security under
-[commands] section in /etc/dnf/automatic.conf.
Rationale:
By default, dnf-automatic installs all available updates.
-Reducing the amount of updated packages only to updates that were
-issued as a part of a security advisory increases the system stability.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only
Identifiers and References
Identifiers: 
-            CCE-91166-9
References: 
-            BP28(R8), SI-2(5), CM-6(a), SI-2(c), FMT_SMF_EXT.1, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:medium
- name: Configure dnf-automatic to Install Only Security Updates
+

Complexity:low
Disruption:medium
- name: Configure dnf-automatic to Install Available Updates Automatically
   ini_file:
     dest: /etc/dnf/automatic.conf
     section: commands
-    option: upgrade_type
-    value: security
+    option: apply_updates
+    value: 'yes'
     create: true
   tags:
-  - CCE-91166-9
+  - CCE-91165-1
   - NIST-800-53-CM-6(a)
   - NIST-800-53-SI-2(5)
   - NIST-800-53-SI-2(c)
-  - dnf-automatic_security_updates_only
+  - dnf-automatic_apply_updates
   - low_complexity
-  - low_severity
   - medium_disruption
+  - medium_severity
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 15 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Print Support
    14. Proxy Server
    15. Samba(SMB) Microsoft Windows File Sharing Server
    16. SNMP Server
    17. SSH Server
    18. X Window System
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 115 groups and 368 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-85671-6
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-6(d), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-15-010420, 1.4.2, SV-234851r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -390,22 +406,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 7 rules
[ref]  
@@ -592,7 +592,21 @@
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References
Identifiers: 
             CCE-92502-4
References: 
-            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm; then
+
+# CAUTION: This remediation script will remove gdm
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 15 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Print Support
    14. Proxy Server
    15. Samba(SMB) Microsoft Windows File Sharing Server
    16. SNMP Server
    17. SSH Server
    18. X Window System
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 103 groups and 297 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-85671-6
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-6(d), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-15-010420, 1.4.2, SV-234851r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -390,22 +406,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 2 rules
[ref]  
@@ -542,7 +542,21 @@
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References
Identifiers: 
             CCE-92502-4
References: 
-            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm; then
+
+# CAUTION: This remediation script will remove gdm
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 15 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. DHCP
    3. DNS Server
    4. FTP Server
    5. Web Server
    6. IMAP and POP3 Server
    7. LDAP
    8. Mail Server Software
    9. NFS and RPC
    10. Network Time Protocol
    11. Obsolete Services
    12. Proxy Server
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 96 groups and 288 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-85671-6
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-6(d), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-15-010420, 1.4.2, SV-234851r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -390,22 +406,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 2 rules
[ref]  
@@ -542,7 +542,21 @@
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References
Identifiers: 
             CCE-92502-4
References: 
-            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm; then
+
+# CAUTION: This remediation script will remove gdm
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html	2023-06-15 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS SUSE Linux Enterprise 15 Benchmark Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 112 groups and 364 rules
Group  
@@ -115,7 +115,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -133,25 +141,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -174,7 +174,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -254,17 +265,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -288,7 +288,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-85671-6
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-6(d), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-15-010420, 1.4.2, SV-234851r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -390,22 +406,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 7 rules
[ref]  
@@ -592,7 +592,21 @@
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References
Identifiers: 
             CCE-92502-4
References: 
-            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm; then
+
+# CAUTION: This remediation script will remove gdm
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html	2023-06-15 00:00:00.000000000 +0000
@@ -73,7 +73,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. Network Routing
    6. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 54 groups and 136 rules
Group  
@@ -141,7 +141,16 @@
 information given by the RPM database. Executables with erroneous hashes could
 be a sign of nefarious activity on the system.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_hashes
Identifiers and References
Identifiers: 
             CCE-85788-8
References: 
-            11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.3.8, 3.4.1, CCI-000366, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), PR.DS-6, PR.DS-8, PR.IP-1, Req-11.5, 11.5.2, SRG-OS-000480-GPOS-00227



+# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
+files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
+
+# From files names get package names and change newline to space, because rpm writes each package to new line
+packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
+
+
+zypper install -f -y $packages_to_reinstall
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: 'Set fact: Package manager reinstall command (dnf)'
   set_fact:
     package_manager_reinstall_cmd: dnf reinstall -y
   when: ansible_distribution == "Fedora"
@@ -300,15 +309,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_hashes
-


-# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
-files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
-
-# From files names get package names and change newline to space, because rpm writes each package to new line
-packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
-
-
-zypper install -f -y $packages_to_reinstall
 
Rule  
                                 Verify and Correct File Permissions with RPM
                                   [ref]
The RPM package management system can check file access permissions
@@ -334,7 +334,32 @@
 The permissions set by the vendor should be maintained. Any deviations from
 this baseline should be investigated.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_permissions
Identifiers and References
Identifiers: 
             CCE-85782-1
References: 
-            1, 11, 12, 13, 14, 15, 16, 18, 3, 5, 6, 9, 5.10.4.1, APO01.06, APO11.04, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.8, 3.4.1, CCI-001493, CCI-001494, CCI-001495, CCI-001496, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4.2, CIP-003-8 R6, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), CM-6(a), PR.AC-4, PR.DS-5, PR.IP-1, PR.PT-1, Req-11.5, 11.5.2, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108, 6.1.1


Complexity:high
Disruption:medium
Strategy:restrict

+# Declare array to hold set of RPM packages we need to correct permissions for
+declare -A SETPERMS_RPM_DICT
+
+# Create a list of files on the system having permissions different from what
+# is expected by the RPM database
+readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
+
+for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
+do
+        # NOTE: some files maybe controlled by more then one package
+        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
+        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
+        do
+                # Use an associative array to store packages as it's keys, not having to care about duplicates.
+                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
+        done
+done
+
+# For each of the RPM packages left in the list -- reset its permissions to the
+# correct values
+for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
+do
+	rpm --restore "${RPM_PACKAGE}"
+done
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: Read list of files with incorrect permissions
   command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
     --nocaps --nolinkto --nouser --nogroup
   register: files_with_incorrect_permissions
@@ -417,31 +442,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_permissions
-

Complexity:high
Disruption:medium
Strategy:restrict

-# Declare array to hold set of RPM packages we need to correct permissions for
-declare -A SETPERMS_RPM_DICT
-
-# Create a list of files on the system having permissions different from what
-# is expected by the RPM database
-readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
-
-for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
-do
-        # NOTE: some files maybe controlled by more then one package
-        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
-        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
-        do
-                # Use an associative array to store packages as it's keys, not having to care about duplicates.
-                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
-        done
-done
-
-# For each of the RPM packages left in the list -- reset its permissions to the
-# correct values
-for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
-do
-	rpm --restore "${RPM_PACKAGE}"
-done
 
Group  
                 System Cryptographic Policies
                           Group contains 2 rules
[ref]  
@@ -484,7 +484,25 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References
Identifiers: 
             CCE-85776-3
References: 
-            164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174



+var_system_crypto_policy='DEFAULT'
+
+
+stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2>&1 > /dev/null)
+rc=$?
+
+if test "$rc" = 127; then
+	echo "$stderr_of_call" >&2
+	echo "Make sure that the script is installed on the remediated system." >&2
+	echo "See output of the 'dnf provides update-crypto-policies' command" >&2
+	echo "to see what package to (re)install" >&2
+
+	false  # end with an error code
+elif test "$rc" != 0; then
+	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
+	false  # end with an error code
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -529,24 +547,6 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
-


-var_system_crypto_policy='DEFAULT'
-
-
-stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2>&1 > /dev/null)
-rc=$?
-
-if test "$rc" = 127; then
-	echo "$stderr_of_call" >&2
-	echo "Make sure that the script is installed on the remediated system." >&2
-	echo "See output of the 'dnf provides update-crypto-policies' command" >&2
-	echo "to see what package to (re)install" >&2
-
-	false  # end with an error code
-elif test "$rc" != 0; then
-	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
-	false  # end with an error code
-fi
 
Rule  
                                 Configure SSH to use System Crypto Policy
                                   [ref]
Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
@@ -557,7 +557,11 @@
 in the /etc/sysconfig/sshd.
Rationale:
Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
 and makes system configuration more fragmented.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
Identifiers and References
Identifiers: 
             CCE-85795-3
References: 
-            CCI-001453, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, FCS_SSH_EXT.1, FCS_SSHS_EXT.1, FCS_SSHC_EXT.1, Req-2.2, 2.2, SRG-OS-000250-GPOS-00093



+SSH_CONF="/etc/sysconfig/sshd"
+
+sed -i "/^\s*CRYPTO_POLICY.*$/Id" $SSH_CONF
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
- name: Configure SSH to use System Crypto Policy
   lineinfile:
     dest: /etc/sysconfig/sshd
     state: absent
@@ -577,10 +581,6 @@
   - medium_disruption
   - medium_severity
   - reboot_required
-


-SSH_CONF="/etc/sysconfig/sshd"
-
-sed -i "/^\s*CRYPTO_POLICY.*$/Id" $SSH_CONF
 
Group  
                 Disk Partitioning
                           Group contains  1 rule
[ref]  
@@ -659,7 +659,69 @@
 After the settings have been set, run dconf update.
Rationale:
Username and password prompting is required for remote access. Otherwise, non-authorized
 and nefarious users can access the system freely.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt
Identifiers and References
Identifiers: 
             CCE-85777-1
References: 
-            3.1.12, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)

Complexity:low
Disruption:medium
- name: Gather the package facts
+            3.1.12, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)

# Remediation is applicable only in certain platforms
+if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+
+# Check for setting in any of the DConf db directories
+# If files contain ibus or distro, ignore them.
+# The assignment assumes that individual filenames don't contain :
+readarray -t SETTINGSFILES < <(grep -r "\\[org/gnome/Vino\\]" "/etc/dconf/db/" \
+                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss-4.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss-4.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss-4.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitlePCI-DSS v4 Control Baseline for SUSE Linux enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_pci-dss-4
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. LDAP
    8. Mail Server Software
    9. NFS and RPC
    10. Network Time Protocol
    11. Obsolete Services
    12. Print Support
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server
    16. System Security Services Daemon
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 103 groups and 259 rules
Group  
@@ -133,7 +133,16 @@
 information given by the RPM database. Executables with erroneous hashes could
 be a sign of nefarious activity on the system.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_hashes
Identifiers and References
Identifiers: 
             CCE-85788-8
References: 
-            11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.3.8, 3.4.1, CCI-000366, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), PR.DS-6, PR.DS-8, PR.IP-1, Req-11.5, 11.5.2, SRG-OS-000480-GPOS-00227



+# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
+files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
+
+# From files names get package names and change newline to space, because rpm writes each package to new line
+packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
+
+
+zypper install -f -y $packages_to_reinstall
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: 'Set fact: Package manager reinstall command (dnf)'
   set_fact:
     package_manager_reinstall_cmd: dnf reinstall -y
   when: ansible_distribution == "Fedora"
@@ -292,15 +301,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_hashes
-


-# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
-files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
-
-# From files names get package names and change newline to space, because rpm writes each package to new line
-packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
-
-
-zypper install -f -y $packages_to_reinstall
 
Rule  
                                 Verify and Correct Ownership with RPM
                                   [ref]
The RPM package management system can check file ownership
@@ -346,7 +346,32 @@
 The permissions set by the vendor should be maintained. Any deviations from
 this baseline should be investigated.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_permissions
Identifiers and References
Identifiers: 
             CCE-85782-1
References: 
-            1, 11, 12, 13, 14, 15, 16, 18, 3, 5, 6, 9, 5.10.4.1, APO01.06, APO11.04, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.8, 3.4.1, CCI-001493, CCI-001494, CCI-001495, CCI-001496, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4.2, CIP-003-8 R6, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), CM-6(a), PR.AC-4, PR.DS-5, PR.IP-1, PR.PT-1, Req-11.5, 11.5.2, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108, 6.1.1


Complexity:high
Disruption:medium
Strategy:restrict

+# Declare array to hold set of RPM packages we need to correct permissions for
+declare -A SETPERMS_RPM_DICT
+
+# Create a list of files on the system having permissions different from what
+# is expected by the RPM database
+readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
+
+for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
+do
+        # NOTE: some files maybe controlled by more then one package
+        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
+        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
+        do
+                # Use an associative array to store packages as it's keys, not having to care about duplicates.
+                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
+        done
+done
+
+# For each of the RPM packages left in the list -- reset its permissions to the
+# correct values
+for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
+do
+	rpm --restore "${RPM_PACKAGE}"
+done
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: Read list of files with incorrect permissions
   command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
     --nocaps --nolinkto --nouser --nogroup
   register: files_with_incorrect_permissions
@@ -429,31 +454,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_permissions
-

Complexity:high
Disruption:medium
Strategy:restrict

-# Declare array to hold set of RPM packages we need to correct permissions for
-declare -A SETPERMS_RPM_DICT
-
-# Create a list of files on the system having permissions different from what
-# is expected by the RPM database
-readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
-
-for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
-do
-        # NOTE: some files maybe controlled by more then one package
-        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
-        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
-        do
-                # Use an associative array to store packages as it's keys, not having to care about duplicates.
-                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
-        done
-done
-
-# For each of the RPM packages left in the list -- reset its permissions to the
-# correct values
-for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
-do
-	rpm --restore "${RPM_PACKAGE}"
-done
 
Group  
                 Verify Integrity with AIDE
                           Group contains 3 rules
[ref]  
@@ -467,7 +467,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -485,25 +493,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -526,7 +526,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -606,17 +617,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -640,7 +640,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitlePCI-DSS v3.2.1 Control Baseline for SUSE Linux enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_pci-dss
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 63 groups and 157 rules
Group  
@@ -133,7 +133,16 @@
 information given by the RPM database. Executables with erroneous hashes could
 be a sign of nefarious activity on the system.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_hashes
Identifiers and References
Identifiers: 
             CCE-85788-8
References: 
-            11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.3.8, 3.4.1, CCI-000366, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), PR.DS-6, PR.DS-8, PR.IP-1, Req-11.5, 11.5.2, SRG-OS-000480-GPOS-00227



+# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
+files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
+
+# From files names get package names and change newline to space, because rpm writes each package to new line
+packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
+
+
+zypper install -f -y $packages_to_reinstall
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: 'Set fact: Package manager reinstall command (dnf)'
   set_fact:
     package_manager_reinstall_cmd: dnf reinstall -y
   when: ansible_distribution == "Fedora"
@@ -292,15 +301,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_hashes
-


-# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
-files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
-
-# From files names get package names and change newline to space, because rpm writes each package to new line
-packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
-
-
-zypper install -f -y $packages_to_reinstall
 
Rule  
                                 Verify and Correct Ownership with RPM
                                   [ref]
The RPM package management system can check file ownership
@@ -346,7 +346,32 @@
 The permissions set by the vendor should be maintained. Any deviations from
 this baseline should be investigated.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_rpm_verify_permissions
Identifiers and References
Identifiers: 
             CCE-85782-1
References: 
-            1, 11, 12, 13, 14, 15, 16, 18, 3, 5, 6, 9, 5.10.4.1, APO01.06, APO11.04, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.8, 3.4.1, CCI-001493, CCI-001494, CCI-001495, CCI-001496, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4.2, CIP-003-8 R6, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CM-6(d), CM-6(c), SI-7, SI-7(1), SI-7(6), AU-9(3), CM-6(a), PR.AC-4, PR.DS-5, PR.IP-1, PR.PT-1, Req-11.5, 11.5.2, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108, 6.1.1


Complexity:high
Disruption:medium
Strategy:restrict

+# Declare array to hold set of RPM packages we need to correct permissions for
+declare -A SETPERMS_RPM_DICT
+
+# Create a list of files on the system having permissions different from what
+# is expected by the RPM database
+readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
+
+for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
+do
+        # NOTE: some files maybe controlled by more then one package
+        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
+        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
+        do
+                # Use an associative array to store packages as it's keys, not having to care about duplicates.
+                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
+        done
+done
+
+# For each of the RPM packages left in the list -- reset its permissions to the
+# correct values
+for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
+do
+	rpm --restore "${RPM_PACKAGE}"
+done
+

Complexity:high
Disruption:medium
Strategy:restrict
- name: Read list of files with incorrect permissions
   command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
     --nocaps --nolinkto --nouser --nogroup
   register: files_with_incorrect_permissions
@@ -429,31 +454,6 @@
   - no_reboot_needed
   - restrict_strategy
   - rpm_verify_permissions
-

Complexity:high
Disruption:medium
Strategy:restrict

-# Declare array to hold set of RPM packages we need to correct permissions for
-declare -A SETPERMS_RPM_DICT
-
-# Create a list of files on the system having permissions different from what
-# is expected by the RPM database
-readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')
-
-for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
-do
-        # NOTE: some files maybe controlled by more then one package
-        readarray -t RPM_PACKAGES < <(rpm -qf "${FILE_PATH}")
-        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
-        do
-                # Use an associative array to store packages as it's keys, not having to care about duplicates.
-                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
-        done
-done
-
-# For each of the RPM packages left in the list -- reset its permissions to the
-# correct values
-for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
-do
-	rpm --restore "${RPM_PACKAGE}"
-done
 
Group  
                 Verify Integrity with AIDE
                           Group contains 3 rules
[ref]  
@@ -467,7 +467,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -485,25 +493,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -526,7 +526,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -606,17 +617,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -640,7 +640,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening-sap.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening-sap.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening-sap.html	2023-06-15 00:00:00.000000000 +0000
@@ -68,7 +68,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleHardening for Public Cloud Image of SUSE Linux Enterprise Server (SLES) for SAP Applications 15
Profile IDxccdf_org.ssgproject.content_profile_pcs-hardening-sap
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Network Time Protocol
    3. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 52 groups and 167 rules
Group  
@@ -113,7 +113,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -131,25 +139,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Configure AIDE to Verify the Audit Tools
                                   [ref]
The operating system file integrity tool must be configured to protect the integrity of the audit tools.
Rationale:
Protecting the integrity of the tools used for auditing purposes is a
@@ -172,7 +172,66 @@
 manipulated, or replaced. An example is a checksum hash of the file or
 files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_check_audit_tools
Identifiers and References
Identifiers: 
             CCE-85610-4
References: 
-            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-15-030630, SV-234962r622137_rule

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
+            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-15-030630, SV-234962r622137_rule

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+
+
+
+
+
+
+
+
+
+if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/augenrules.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/audispd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
   package:
     name: '{{ item }}'
     state: present
@@ -250,65 +309,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-
-
-
-
-
-
-
-
-
-if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/augenrules.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/audispd.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -332,7 +332,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-85671-6
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-6(d), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-15-010420, 1.4.2, SV-234851r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html	2023-06-15 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitlePublic Cloud Hardening for SUSE Linux Enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_pcs-hardening
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Network Time Protocol
    3. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 54 groups and 165 rules
Group  
@@ -127,7 +127,66 @@
 manipulated, or replaced. An example is a checksum hash of the file or
 files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_check_audit_tools
Identifiers and References
Identifiers: 
             CCE-85610-4
References: 
-            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-15-030630, SV-234962r622137_rule

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
+            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-15-030630, SV-234962r622137_rule

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+
+
+
+
+
+
+
+
+
+if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/augenrules.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/audispd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
   package:
     name: '{{ item }}'
     state: present
@@ -205,65 +264,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-
-
-
-
-
-
-
-
-
-if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/augenrules.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/audispd.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -287,7 +287,23 @@
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
Identifiers: 
             CCE-85671-6
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-6(d), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SLES-15-010420, 1.4.2, SV-234851r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+zypper install -y "crontabs"
+
+if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -389,22 +405,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-zypper install -y "crontabs"
-
-if ! grep -q "/usr/bin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/bin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure AIDE to Verify Access Control Lists (ACLs)
                                   [ref]
By default, the acl option is added to the FIPSR ruleset in AIDE.
@@ -419,7 +419,35 @@
 /etc/aide.conf
Rationale:
ACLs can provide permissions beyond those permitted through the file mode and must be
 verified by the file integrity tools.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_aide_verify_acls
Identifiers and References
Identifiers: 
             CCE-85623-7
References: 
-            BP28(R51), 2, 3, APO01.06, BAI03.05, BAI06.01, DSS06.02, CCI-000366, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, A.11.2.4, A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3, A.14.2.4, SI-7, SI-7(1), CM-6(a), PR.DS-6, PR.DS-8, SRG-OS-000480-GPOS-00227, SLES-15-040040, SV-234986r622137_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
@@ -68,7 +68,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleStandard System Security Profile for SUSE Linux Enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_standard
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Web Server
    4. Network Time Protocol
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 45 groups and 111 rules
Group  
@@ -209,7 +209,10 @@
 users may take advantage of weaknesses in the unpatched software. The
 lack of prompt attention to patching could result in a system compromise.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_security_patches_up_to_date
Identifiers and References
Identifiers: 
             CCE-83261-8
References: 
-            BP28(R08), 18, 20, 4, 5.10.4.1, APO12.01, APO12.02, APO12.03, APO12.04, BAI03.10, DSS05.01, DSS05.02, CCI-000366, CCI-001227, 4.2.3, 4.2.3.12, 4.2.3.7, 4.2.3.9, A.12.6.1, A.14.2.3, A.16.1.3, A.18.2.2, A.18.2.3, SI-2(5), SI-2(c), CM-6(a), ID.RA-1, PR.IP-12, FMT_MOF_EXT.1, Req-6.2, 6.3.3, SRG-OS-000480-GPOS-00227, SLES-15-010010, 1.9, SV-234802r622137_rule


Complexity:low
Disruption:high
Reboot:true
Strategy:patch

+
+zypper patch -g security -y
+

Complexity:low
Disruption:high
Reboot:true
Strategy:patch
- name: Security patches are up to date
   package:
     name: '*'
     state: latest
@@ -229,9 +232,6 @@
   - reboot_required
   - security_patches_up_to_date
   - skip_ansible_lint
-

Complexity:low
Disruption:high
Reboot:true
Strategy:patch

-
-zypper patch -g security -y
 
Group  
                 Account and Access Control
                           Group contains 7 groups and 8 rules
[ref]  
@@ -310,7 +310,114 @@
 access via user password guessing, otherwise known as brute-forcing, is reduced.
 Limits are imposed by locking the account.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
Identifiers and References
Identifiers: 
             CCE-91169-3
References: 
-            BP28(R18), 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, CCI-000044, CCI-002236, CCI-002237, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(a), PR.AC-7, FIA_AFL.1, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005


# Remediation is applicable only in certain platforms
+if rpm --quiet -q pam; then
+
+var_accounts_passwords_pam_faillock_fail_interval='900'
+
+
+if [ -f /usr/bin/authselect ]; then
+    if ! authselect check; then
+echo "
+authselect integrity check failed. Remediation aborted!
+This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
+It is not recommended to manually edit the PAM files when authselect tool is available.
+In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
+exit 1
+fi
+authselect enable-feature with-faillock
+
+authselect apply-changes -b
+else
+    
+AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
+for pam_file in "${AUTH_FILES[@]}"
+do
+    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
+        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
+        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
+        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
+    fi
+    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
+done
+
+fi
+
+AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
+
+FAILLOCK_CONF="/etc/security/faillock.conf"
+if [ -f $FAILLOCK_CONF ]; then
+    regex="^\s*fail_interval\s*="
+    line="fail_interval = $var_accounts_passwords_pam_faillock_fail_interval"
+    if ! grep -q $regex $FAILLOCK_CONF; then
+        echo $line >> $FAILLOCK_CONF
+    else
+        sed -i --follow-symlinks 's|^\s*\(fail_interval\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_fail_interval"'|g' $FAILLOCK_CONF
+    fi
+    for pam_file in "${AUTH_FILES[@]}"
+    do
+        if [ -e "$pam_file" ] ; then
+            PAM_FILE_PATH="$pam_file"
+            if [ -f /usr/bin/authselect ]; then
+                
+                if ! authselect check; then
+                echo "
+                authselect integrity check failed. Remediation aborted!
+                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
+                It is not recommended to manually edit the PAM files when authselect tool is available.
+                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
+                exit 1
+                fi
+
+                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
+                # If not already in use, a custom profile is created preserving the enabled features.
+                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
+                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    authselect create-profile hardening -b $CURRENT_PROFILE
+                    CURRENT_PROFILE="custom/hardening"
+                    
+                    authselect apply-changes -b --backup=before-hardening-custom-profile
+                    authselect select $CURRENT_PROFILE
+                    for feature in $ENABLED_FEATURES; do
+                        authselect enable-feature $feature;
+                    done
+                    
+                    authselect apply-changes -b --backup=after-hardening-custom-profile
+                fi
+                PAM_FILE_NAME=$(basename "$pam_file")
+                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"
+
+                authselect apply-changes -b
+            fi
+            
+        if grep -qP '^\s*auth\s.*\bpam_faillock.so\s.*\bfail_interval\b' "$PAM_FILE_PATH"; then
+            sed -i -E --follow-symlinks 's/(.*auth.*pam_faillock.so.*)\bfail_interval\b=?[[:alnum:]]*(.*)/\1\2/g' "$PAM_FILE_PATH"
+        fi
+            if [ -f /usr/bin/authselect ]; then
+                
+                authselect apply-changes -b
+            fi
+        else
+            echo "$pam_file was not found" >&2
+        fi
+    done
+else
+    for pam_file in "${AUTH_FILES[@]}"
+    do
+        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*fail_interval' "$pam_file"; then
+            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ fail_interval='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
+            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ fail_interval='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
+        else
+            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*preauth.*silent.*\)\('"fail_interval"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'\3/' "$pam_file"
+            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*authfail.*\)\('"fail_interval"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'\3/' "$pam_file"
+        fi
+    done
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -962,113 +1069,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if rpm --quiet -q pam; then
-
-var_accounts_passwords_pam_faillock_fail_interval='900'
-
-
-if [ -f /usr/bin/authselect ]; then
-    if ! authselect check; then
-echo "
-authselect integrity check failed. Remediation aborted!
-This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
-It is not recommended to manually edit the PAM files when authselect tool is available.
-In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
-exit 1
-fi
-authselect enable-feature with-faillock
-
-authselect apply-changes -b
-else
-    
-AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
-for pam_file in "${AUTH_FILES[@]}"
-do
-    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
-        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
-        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
-        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
-    fi
-    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
-done
-
-fi
-
-AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
-
-FAILLOCK_CONF="/etc/security/faillock.conf"
-if [ -f $FAILLOCK_CONF ]; then
-    regex="^\s*fail_interval\s*="
-    line="fail_interval = $var_accounts_passwords_pam_faillock_fail_interval"
-    if ! grep -q $regex $FAILLOCK_CONF; then
-        echo $line >> $FAILLOCK_CONF
-    else
-        sed -i --follow-symlinks 's|^\s*\(fail_interval\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_fail_interval"'|g' $FAILLOCK_CONF
-    fi
-    for pam_file in "${AUTH_FILES[@]}"
-    do
-        if [ -e "$pam_file" ] ; then
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html	2023-06-15 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleDISA STIG for SUSE Linux Enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_stig
CPE Platforms
  • cpe:/o:suse:linux_enterprise_desktop:15
  • cpe:/o:suse:linux_enterprise_server:15
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Base Services
    2. FTP Server
    3. Mail Server Software
    4. NFS and RPC
    5. Network Time Protocol
    6. Obsolete Services
    7. SSH Server
    8. System Security Services Daemon
Checklist
Group  
                 Guide to the Secure Configuration of SUSE Linux Enterprise 15
                           Group contains 83 groups and 239 rules
Group  
@@ -111,7 +111,15 @@
 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
Identifiers: 
             CCE-83289-9
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -129,25 +137,17 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
   package { 'aide':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -170,7 +170,18 @@
 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
Identifiers: 
             CCE-85787-0
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, SLES-15-010419, 1.4.1


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+/usr/bin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -250,17 +261,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-/usr/bin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure AIDE to Verify the Audit Tools
                                   [ref]
The operating system file integrity tool must be configured to protect the integrity of the audit tools.
Rationale:
Protecting the integrity of the tools used for auditing purposes is a
@@ -283,7 +283,66 @@
 manipulated, or replaced. An example is a checksum hash of the file or
 files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_check_audit_tools
Identifiers and References
Identifiers: 
             CCE-85610-4
References: 
-            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-15-030630, SV-234962r622137_rule

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
+            CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108, SLES-15-030630, SV-234962r622137_rule

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+zypper install -y "aide"
+
+
+
+
+
+
+
+
+
+
+if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/augenrules.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+if grep -i '^.*/usr/sbin/audispd.*$' /etc/aide.conf; then
+sed -i "s#.*/usr/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
+else
+echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure aide is installed
   package:
     name: '{{ item }}'
     state: present
@@ -361,65 +420,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

Complexity:low
Disruption:low
Strategy:restrict
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-zypper install -y "aide"
-
-
-
-
-
-
-
-
-
-
-if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
-
-if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
-sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
-else
-echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
-fi
/usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
@@ -45,7 +45,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of openSUSE
       This guide presents a catalog of security-relevant
 configuration settings for openSUSE. It is a rendering of
@@ -88,14 +88,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -103,54 +103,55 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -158,26 +159,24 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -188,19 +187,20 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -1699,20 +1699,6 @@
               BP28(R58)
               Restricting the capability of sudo allowed commands to execute sub-commands
 prevents users from running programs with privileges they wouldn't have otherwise.
-              - name: Ensure noexec is enabled in /etc/sudoers
-  lineinfile:
-    path: /etc/sudoers
-    regexp: ^[\s]*Defaults.*\bnoexec\b.*$
-    line: Defaults noexec
-    validate: /usr/sbin/visudo -cf %s
-  tags:
-  - high_severity
-  - low_complexity
-  - low_disruption
-  - no_reboot_needed
-  - restrict_strategy
-  - sudo_add_noexec
-
               
 if /usr/sbin/visudo -qcf /etc/sudoers; then
     cp /etc/sudoers /etc/sudoers.bak
@@ -1734,6 +1720,20 @@
     false
 fi
 
/usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml	2023-06-15 00:00:00.000000000 +0000
@@ -45,7 +45,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of openSUSE
       This guide presents a catalog of security-relevant
 configuration settings for openSUSE. It is a rendering of
@@ -88,14 +88,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -103,54 +103,55 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -158,26 +159,24 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -188,19 +187,20 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -1699,20 +1699,6 @@
               BP28(R58)
               Restricting the capability of sudo allowed commands to execute sub-commands
 prevents users from running programs with privileges they wouldn't have otherwise.
-              - name: Ensure noexec is enabled in /etc/sudoers
-  lineinfile:
-    path: /etc/sudoers
-    regexp: ^[\s]*Defaults.*\bnoexec\b.*$
-    line: Defaults noexec
-    validate: /usr/sbin/visudo -cf %s
-  tags:
-  - high_severity
-  - low_complexity
-  - low_disruption
-  - no_reboot_needed
-  - restrict_strategy
-  - sudo_add_noexec
-
               
 if /usr/sbin/visudo -qcf /etc/sudoers; then
     cp /etc/sudoers /etc/sudoers.bak
@@ -1734,6 +1720,20 @@
     false
 fi
 
/usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml	2023-06-15 00:00:00.000000000 +0000
@@ -7,1030 +7,1030 @@
     2023-06-15T00:00:00
   
   
-    
-      Disable support for /proc/kkcore
+    
+      Ensure Log Files Are Owned By Appropriate User
       
-        ocil:ssg-kernel_config_proc_kcore_action:testaction:1
+        ocil:ssg-rsyslog_files_ownership_action:testaction:1
       
     
-    
-      Ensure System Log Files Have Correct Permissions
+    
+      Ensure auditd Collects File Deletion Events by User - rmdir
       
-        ocil:ssg-rsyslog_files_permissions_action:testaction:1
+        ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1
       
     
-    
-      Kernel panic timeout
+    
+      Verify User Who Owns Backup passwd File
       
-        ocil:ssg-kernel_config_panic_timeout_action:testaction:1
+        ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Ensure All Accounts on the System Have Unique Names
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-account_unique_name_action:testaction:1
       
     
-    
-      Disable x86 vsyscall emulation
+    
+      Enable checks on scatter-gather (SG) table operations
       
-        ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1
+        ocil:ssg-kernel_config_debug_sg_action:testaction:1
       
     
-    
-      Ensure auditd Collects File Deletion Events by User - renameat
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Disable Kerberos Authentication
+    
+      Ensure logrotate is Installed
       
-        ocil:ssg-sshd_disable_kerb_auth_action:testaction:1
+        ocil:ssg-package_logrotate_installed_action:testaction:1
       
     
-    
-      Ensure No World-Writable Files Exist
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Ensure SMEP is not disabled during boot
+    
+      Account Lockouts Must Be Logged
       
-        ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1
+        ocil:ssg-accounts_passwords_pam_faillock_audit_action:testaction:1
       
     
-    
-      Verify Group Who Owns group File
+    
+      Restrict Virtual Console Root Logins
       
-        ocil:ssg-file_groupowner_etc_group_action:testaction:1
+        ocil:ssg-securetty_root_login_console_only_action:testaction:1
       
     
-    
-      Add nosuid Option to /dev/shm
+    
+      Verify that Shared Library Files Have Restrictive Permissions
       
-        ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1
+        ocil:ssg-file_permissions_library_dirs_action:testaction:1
       
     
-    
-      Remove the OpenSSH Server Package
+    
+      Audit Configuration Files Must Be Owned By Root
       
-        ocil:ssg-package_openssh-server_removed_action:testaction:1
+        ocil:ssg-file_ownership_audit_configuration_action:testaction:1
       
     
-    
-      Unmap kernel when running in userspace (aka KAISER)
+    
+      Disable RDS Support
       
-        ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1
+        ocil:ssg-kernel_module_rds_disabled_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Record Events that Modify the System's Mandatory Access Controls in usr/share
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-audit_rules_mac_modification_usr_share_action:testaction:1
       
     
-    
-      Configure Sending and Accepting Shared Media Redirects by Default
+    
+      Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
       
-        ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1
+        ocil:ssg-sudo_remove_no_authenticate_action:testaction:1
       
     
-    
-      Disable Accepting Packets Routed Between Local Interfaces
+    
+      Sign kernel modules with SHA-512
       
-        ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1
+        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
       
     
-    
-      The Chrony package is installed
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-package_chrony_installed_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      Verify Permissions on passwd File
+    
+      Record Events that Modify the System's Discretionary Access Controls - lsetxattr
       
-        ocil:ssg-file_permissions_etc_passwd_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1
       
     
-    
-      Verify Ownership on SSH Server Public *.pub Key Files
+    
+      Ensure Rsyslog Authenticates Off-Loaded Audit Records
       
-        ocil:ssg-file_ownership_sshd_pub_key_action:testaction:1
+        ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1
       
     
-    
-      Kernel panic oops
+    
+      Specify module signing key to use
       
-        ocil:ssg-kernel_config_panic_on_oops_action:testaction:1
+        ocil:ssg-kernel_config_module_sig_key_action:testaction:1
       
     
-    
-      Set SSH MaxSessions limit
+    
+      Specify the hash to use when signing modules
       
-        ocil:ssg-sshd_set_max_sessions_action:testaction:1
+        ocil:ssg-kernel_config_module_sig_hash_action:testaction:1
       
     
-    
-      Configure auditd max_log_file_action Upon Reaching Maximum Log Size
+    
+      Configure System to Forward All Mail For The Root Account
       
/usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of openSUSE
   This guide presents a catalog of security-relevant
 configuration settings for openSUSE. It is a rendering of
@@ -43,14 +43,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
+    
       
-        
-          
-        
-        
-          
-        
+        
+      
+    
+    
+      
+        
       
     
     
@@ -58,54 +58,55 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -113,26 +114,24 @@
         
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
-        
-      
-    
-    
-      
-        
+        
+          
+        
+        
+          
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -143,19 +142,20 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
   
@@ -1654,20 +1654,6 @@
           BP28(R58)
           Restricting the capability of sudo allowed commands to execute sub-commands
 prevents users from running programs with privileges they wouldn't have otherwise.
-          - name: Ensure noexec is enabled in /etc/sudoers
-  lineinfile:
-    path: /etc/sudoers
-    regexp: ^[\s]*Defaults.*\bnoexec\b.*$
-    line: Defaults noexec
-    validate: /usr/sbin/visudo -cf %s
-  tags:
-  - high_severity
-  - low_complexity
-  - low_disruption
-  - no_reboot_needed
-  - restrict_strategy
-  - sudo_add_noexec
-
           
 if /usr/sbin/visudo -qcf /etc/sudoers; then
     cp /etc/sudoers /etc/sudoers.bak
@@ -1689,6 +1675,20 @@
     false
 fi
 
+          - name: Ensure noexec is enabled in /etc/sudoers
/usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
@@ -37,7 +37,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 12
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 12. It is a rendering of
@@ -80,14 +80,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -95,86 +95,94 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -183,43 +191,36 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
+            
           
         
-        
+        
           
-            
+            
           
/usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml	2023-06-15 00:00:00.000000000 +0000
@@ -39,7 +39,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 12
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 12. It is a rendering of
@@ -82,14 +82,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -97,86 +97,94 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -185,43 +193,36 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
+            
           
         
-        
+        
           
-            
+            
           
/usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml	2023-06-15 00:00:00.000000000 +0000
@@ -7,1720 +7,1720 @@
     2023-06-15T00:00:00
   
   
-    
-      Ensure All World-Writable Directories Are Owned by root user
+    
+      Ensure sudo passwd_timeout is appropriate - sudo passwd_timeout
       
-        ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1
+        ocil:ssg-sudo_add_passwd_timeout_action:testaction:1
       
     
-    
-      Remove Default Configuration to Disable Syscall Auditing
+    
+      Ensure Log Files Are Owned By Appropriate User
       
-        ocil:ssg-audit_rules_enable_syscall_auditing_action:testaction:1
+        ocil:ssg-rsyslog_files_ownership_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
+    
+      Ensure auditd Collects File Deletion Events by User - rmdir
       
-        ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1
+        ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1
       
     
-    
-      Disable support for /proc/kkcore
+    
+      Verify User Who Owns Backup passwd File
       
-        ocil:ssg-kernel_config_proc_kcore_action:testaction:1
+        ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1
       
     
-    
-      Add nosuid Option to /home
+    
+      Ensure All Accounts on the System Have Unique Names
       
-        ocil:ssg-mount_option_home_nosuid_action:testaction:1
+        ocil:ssg-account_unique_name_action:testaction:1
       
     
-    
-      Configure a Sufficiently Large Partition for Audit Logs
+    
+      Disable Mounting of cramfs
       
-        ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1
+        ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1
       
     
-    
-      Ensure System Log Files Have Correct Permissions
+    
+      Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
       
-        ocil:ssg-rsyslog_files_permissions_action:testaction:1
+        ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1
       
     
-    
-      Verify '/proc/sys/crypto/fips_enabled' exists
+    
+      Verify permissions on Message of the Day Banner
       
-        ocil:ssg-is_fips_mode_enabled_action:testaction:1
+        ocil:ssg-file_permissions_etc_motd_action:testaction:1
       
     
-    
-      Assign Expiration Date to Temporary Accounts
+    
+      Enable checks on scatter-gather (SG) table operations
       
-        ocil:ssg-account_temp_expire_date_action:testaction:1
+        ocil:ssg-kernel_config_debug_sg_action:testaction:1
       
     
-    
-      Kernel panic timeout
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-kernel_config_panic_timeout_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Ensure logrotate is Installed
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-package_logrotate_installed_action:testaction:1
       
     
-    
-      Ensure shadow Group is Empty
+    
+      Install Intrusion Detection Software
       
-        ocil:ssg-ensure_shadow_group_empty_action:testaction:1
+        ocil:ssg-install_hids_action:testaction:1
       
     
-    
-      Set Existing Passwords Warning Age
+    
+      Add nosuid Option to /tmp
       
-        ocil:ssg-accounts_password_set_warn_age_existing_action:testaction:1
+        ocil:ssg-mount_option_tmp_nosuid_action:testaction:1
       
     
-    
-      Disable Core Dumps for All Users
+    
+      Ensure auditd Collects Information on the Use of Privileged Commands - mount
       
-        ocil:ssg-disable_users_coredumps_action:testaction:1
+        ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1
       
     
-    
-      Disable x86 vsyscall emulation
+    
+      Verify Group Who Owns cron.d
       
-        ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1
+        ocil:ssg-file_groupowner_cron_d_action:testaction:1
       
     
-    
-      All Interactive User Home Directories Must Be Group-Owned By The Primary Group
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-file_groupownership_home_directories_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Ensure auditd Collects File Deletion Events by User - renameat
+    
+      Only Allow Authorized Network Services in SuSEfirewall2
       
-        ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1
+        ocil:ssg-susefirewall2_only_required_services_action:testaction:1
       
     
-    
-      Set Password Minimum Length
+    
+      Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default
       
-        ocil:ssg-cracklib_accounts_password_pam_minlen_action:testaction:1
+        ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_action:testaction:1
       
     
-    
-      Set PAM''s Password Hashing Algorithm
+    
+      Account Lockouts Must Be Logged
       
-        ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1
+        ocil:ssg-accounts_passwords_pam_faillock_audit_action:testaction:1
       
     
-    
-      Disable Kerberos Authentication
+    
+      Configure the polyinstantiation_enabled SELinux Boolean
       
-        ocil:ssg-sshd_disable_kerb_auth_action:testaction:1
+        ocil:ssg-sebool_polyinstantiation_enabled_action:testaction:1
       
     
-    
-      Uninstall avahi Server Package
+    
+      Restrict Virtual Console Root Logins
       
-        ocil:ssg-package_avahi_removed_action:testaction:1
+        ocil:ssg-securetty_root_login_console_only_action:testaction:1
       
     
-    
-      Uninstall talk Package
+    
+      Ensure gpgcheck Enabled In Main zypper Configuration
       
/usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of SUSE Linux Enterprise 12
   This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 12. It is a rendering of
@@ -43,14 +43,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
+    
       
-        
-          
-        
-        
-          
-        
+        
+      
+    
+    
+      
+        
       
     
     
@@ -58,86 +58,94 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
+          
+        
+        
+          
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+          
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
-        
+        
       
     
-    
-      
-        
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -146,43 +154,36 @@
         
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
-        
-      
-    
-    
-      
-        
-      
-    
-    
-      
-        
+        
       
     
-    
+    
       
-        
+        
       
     
/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
@@ -37,7 +37,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 15
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 15. It is a rendering of
@@ -80,74 +80,79 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -155,71 +160,72 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
             
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
/usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml	2023-06-15 00:00:00.000000000 +0000
@@ -39,7 +39,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 15
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 15. It is a rendering of
@@ -82,74 +82,79 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+              
+            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -157,71 +162,72 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
             
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
/usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml	2023-06-15 00:00:00.000000000 +0000
@@ -7,1084 +7,1060 @@
     2023-06-15T00:00:00
   
   
-    
-      Ensure All World-Writable Directories Are Owned by root user
-      
-        ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1
-      
-    
-    
-      Remove Default Configuration to Disable Syscall Auditing
-      
-        ocil:ssg-audit_rules_enable_syscall_auditing_action:testaction:1
-      
-    
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
-      
-        ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1
-      
-    
-    
-      Disable support for /proc/kkcore
-      
-        ocil:ssg-kernel_config_proc_kcore_action:testaction:1
-      
-    
-    
-      Add nosuid Option to /home
+    
+      Ensure auditd Collects Information on the Use of Privileged Commands - postqueue
       
-        ocil:ssg-mount_option_home_nosuid_action:testaction:1
+        ocil:ssg-audit_rules_privileged_commands_postqueue_action:testaction:1
       
     
-    
-      Configure a Sufficiently Large Partition for Audit Logs
+    
+      Ensure sudo passwd_timeout is appropriate - sudo passwd_timeout
       
-        ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1
+        ocil:ssg-sudo_add_passwd_timeout_action:testaction:1
       
     
-    
-      Ensure System Log Files Have Correct Permissions
+    
+      Ensure Log Files Are Owned By Appropriate User
       
-        ocil:ssg-rsyslog_files_permissions_action:testaction:1
+        ocil:ssg-rsyslog_files_ownership_action:testaction:1
       
     
-    
-      Verify '/proc/sys/crypto/fips_enabled' exists
+    
+      Disable Quagga Service
       
-        ocil:ssg-is_fips_mode_enabled_action:testaction:1
+        ocil:ssg-service_zebra_disabled_action:testaction:1
       
     
-    
-      Assign Expiration Date to Temporary Accounts
+    
+      Ensure SELinux Not Disabled in /etc/default/grub
       
-        ocil:ssg-account_temp_expire_date_action:testaction:1
+        ocil:ssg-grub2_enable_selinux_action:testaction:1
       
     
-    
-      Kernel panic timeout
+    
+      Ensure auditd Collects File Deletion Events by User - rmdir
       
-        ocil:ssg-kernel_config_panic_timeout_action:testaction:1
+        ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Verify User Who Owns Backup passwd File
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1
       
     
-    
-      Ensure shadow Group is Empty
+    
+      Ensure All Accounts on the System Have Unique Names
       
-        ocil:ssg-ensure_shadow_group_empty_action:testaction:1
+        ocil:ssg-account_unique_name_action:testaction:1
       
     
-    
-      Set Existing Passwords Warning Age
+    
+      Disable Mounting of cramfs
       
-        ocil:ssg-accounts_password_set_warn_age_existing_action:testaction:1
+        ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1
       
     
-    
-      Disable Core Dumps for All Users
+    
+      Ensure No Daemons are Unconfined by SELinux
       
-        ocil:ssg-disable_users_coredumps_action:testaction:1
+        ocil:ssg-selinux_confinement_of_daemons_action:testaction:1
       
     
-    
-      Disable x86 vsyscall emulation
+    
+      Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
       
-        ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1
+        ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1
       
     
-    
-      All Interactive User Home Directories Must Be Group-Owned By The Primary Group
+    
+      Verify permissions on Message of the Day Banner
       
-        ocil:ssg-file_groupownership_home_directories_action:testaction:1
+        ocil:ssg-file_permissions_etc_motd_action:testaction:1
       
     
-    
-      Ensure auditd Collects File Deletion Events by User - renameat
+    
+      Enable checks on scatter-gather (SG) table operations
       
-        ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1
+        ocil:ssg-kernel_config_debug_sg_action:testaction:1
       
     
-    
-      Set Password Minimum Length
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-cracklib_accounts_password_pam_minlen_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Set PAM''s Password Hashing Algorithm
+    
+      Ensure logrotate is Installed
       
-        ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1
+        ocil:ssg-package_logrotate_installed_action:testaction:1
       
     
-    
-      Disable Kerberos Authentication
+    
+      Install Intrusion Detection Software
       
-        ocil:ssg-sshd_disable_kerb_auth_action:testaction:1
+        ocil:ssg-install_hids_action:testaction:1
       
     
-    
-      Uninstall avahi Server Package
+    
+      Add nosuid Option to /tmp
       
-        ocil:ssg-package_avahi_removed_action:testaction:1
+        ocil:ssg-mount_option_tmp_nosuid_action:testaction:1
       
     
-    
-      Uninstall talk Package
+    
+      Ensure auditd Collects Information on the Use of Privileged Commands - mount
       
-        ocil:ssg-package_talk_removed_action:testaction:1
+        ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1
       
     
-    
-      Ensure All Groups on the System Have Unique Group ID
+    
+      Verify Group Who Owns cron.d
       
-        ocil:ssg-group_unique_id_action:testaction:1
+        ocil:ssg-file_groupowner_cron_d_action:testaction:1
       
/usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of SUSE Linux Enterprise 15
   This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 15. It is a rendering of
@@ -43,74 +43,79 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
+    
       
-        
-          
-        
-        
-          
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
+          
+        
+        
+          
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+          
+        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -118,71 +123,72 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
-        
+    
+      
+        
       
     
-    
-      
-        
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
         
-        
+        
       
     
-    
-      
-        
+    
+      
+        
       
     
-    
-      
-        
+    
+      
+        
       
     
-    
+    
       
RPMS.2017/scap-security-guide-debian-0.1.68-0.0.noarch.rpm RPMS/scap-security-guide-debian-0.1.68-0.0.noarch.rpm differ: byte 225, line 1
Comparing scap-security-guide-debian-0.1.68-0.0.noarch.rpm to scap-security-guide-debian-0.1.68-0.0.noarch.rpm
comparing the rpm tags of scap-security-guide-debian
--- old-rpm-tags
+++ new-rpm-tags
@@ -157,4 +157,4 @@
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html d956bba1eb96b090eab4183c7c215e18fd1d983320fb74455a9a2bef04f098d9 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html 6a3826ed13c2e363e959a3c0efbd0756107a946c7f598f46a0ce732dcb12e323 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html dc513d0faaec6b4b50604d35296067459eddc62b874f7f1067ca86aa65fdb33f 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html 59772b8e18bbdfd8e75f857239b3630835412eddc7a648528bc0254c350a0846 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html f74964ef01bfaefacdd490c4481a567d1a0ee7d2fdd841f97a652cdda95d8d47 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html a2c1edab3ae78b840a4176da550ed977170de1c5227547df0f7c299402b3dcd4 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html adde1533507c7f5c837683c75d16fe1b562b54638d40f101d65c3a6f32feb798 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html 58652f2aa7406d55e58f0e9841e8d6d32a58948711134dc14361aabd5065c257 2
@@ -162,5 +162,5 @@
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html ed58d0c0505ced8bdab313f6a51a8eb115a116bb5ce34b23f3a3864a2e78ef31 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html 4d62682a5684c3208c9cd3def6efd6b97973950edef8f47d2e5c75fc0b63d3fd 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html c637daada70682467e9e000369cdd50678703a85b6611d3a596e6c03707845b3 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html d5a2edf6e466b85fa89b488310824f2479d4dccc9e0bd46f1353a9f202d692b4 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html aa378d12b1641dc6c0bc97a0a68378ce72a8b75e7fc1573492197bb4fb843853 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html 77a7297e796aa0bcd3a050be5f8e7be8627dadd1ef696d31dc5212b69cb82d2e 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html 68306519487e5f54d8c0f2111adbbe1285d1173d766f02ece773a2e4ffddb707 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html c92ff8f28c035c2837662f842de4e160a2190c87eb8fa2b2b51e7439593409d3 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html fc2d9a9bb0c8488c4bf4b3e74f9c66dfefc29cc294707a308e043e578bab1bec 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html 0fdb3b602daa96ee176cc08f006d0ff0a02a1a676a9fd076d00d059e4b458f87 2
@@ -168 +168 @@
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html 67967bfb7f136c7118580913d3fba4b7937f24ebd39da4518b8f8c2209d9d6af 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html aceb6bd3a3f3f7942a8f594ac9c3e5d86dc6e45e24d1cac50b55210a50e80dd8 2
@@ -201,3 +201,3 @@
-/usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml f042df13ffc78d12c73e058d57d2ae3da8fdcdbbd7689921a24c8e62486721cf 0
-/usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml 7350f9495815e97a3d9a15578a56d5f96bdcc397505f40dbf105e2fa7438b75a 0
-/usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml 98bd37218000348d3cba6a0858ca169a84584da55de6bf57b6803dffbfcd41f2 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml c47feedbeae406054f38242bcbe0b0ce8c1a53fdb634ebb4000a44b144ac27c5 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml 0d19046a819bd240ef0419b05dc61ff13e4fcca22753fea85c42b2e3fff2cbe8 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml 36f3f6f2889d0523896eb892ca271e9385052630a5743f72e5eb87c3e55f8e73 0
@@ -205 +205 @@
-/usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml 8ca79a9648b78ff7fcc696e3e626cb162bf84c2c5b2ba8cbc1227428fa77c4af 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml b5f38cb9a7f0d70258cca9727bf121b3e87f62500aec61759749eba36bb30e61 0
@@ -208,3 +208,3 @@
-/usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml 4291354019fb66016a1af491029d6a6cee91145cb4b74ab8441a9b1a6738629b 0
-/usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml 4e64131616167eda77cb522d4c49d9cbfdac6050f1126abb6c6e95af4d990547 0
-/usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml 41d98ea98b4c52102e3bab379a72d6c53ced50c62330ca7241bbf431094e98a2 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml 8f546260b000d1b833e816abfcab71fae3d9297e593b55abc7ea566e0e0b0a43 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml dfb14c1c79b91bf30d5896a0989658b4527403932c41a019ec67d0ab9930c955 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml 1bc98086462a38e660eef929b329f3268240e9c647cf3ecab66767f3fe8796db 0
@@ -212 +212 @@
-/usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml ff1aa7ead43ad37cc3fa9f3de4bbb83952f9f830f0e3d341797e63749646223d 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml 3b3389abf09b434db5715c0f876114b5e43128970d04bfa47cf265830001decf 0
comparing rpmtags
comparing RELEASE
comparing PROVIDES
comparing scripts
comparing filelist
comparing file checksum
creating rename script
RPM file checksum differs.
Extracting packages
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleProfile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_average
CPE Platforms
  • cpe:/o:debian:debian_linux:10
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Debian 10
                           Group contains 20 groups and 45 rules
Group  
@@ -165,7 +165,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -198,33 +213,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -257,21 +272,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 Configure Syslog
                           Group contains 3 groups and 8 rules
[ref]  
@@ -333,7 +333,109 @@
 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
 configuration, user authentication, and other such information. Log files should be
 protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
Identifiers and References
References: 
-            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	# From each of these files extract just particular log file path(s), thus:
+	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
+	# * Ignore empty lines,
+	# * Strip quotes and closing brackets from paths.
+	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
+	# * From the remaining valid rows select only fields constituting a log file path
+	# Text file column is understood to represent a log file path if and only if all of the
+	# following are met:
+	# * it contains at least one slash '/' character,
+	# * it is preceded by space
+	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
+	# Search log file for path(s) only in case it exists!
+	if [[ -f "${LOG_FILE}" ]]
+	then
+		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
+		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")
+		FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")
+		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
+		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
+		# Since above sed command might return more than one item (delimited by newline), split
+		# the particular matches entries into new array specific for this log file
+		readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS"
+		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
+		# items from newly created array for this log file
+		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
+		# Delete the temporary array
+		unset ARRAY_FOR_LOG_FILE
+	fi
+done
+
+# Check for RainerScript action log format which might be also multiline so grep regex is a bit
+# curly:
+# extract possibly multiline action omfile expressions
+# extract File="logfile" expression
+# match only "logfile" expression
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	ACTION_OMFILE_LINES=$(grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
+	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
+	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
+done
+
+# Ensure the correct attribute if file exists
+FILE_CMD="chgrp"
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleProfile for ANSSI DAT-NT28 High (Enforced) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_high
CPE Platforms
  • cpe:/o:debian:debian_linux:10
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Debian 10
                           Group contains 23 groups and 50 rules
Group  
@@ -165,7 +165,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -198,33 +213,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -257,21 +272,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 System Accounting with auditd
                           Group contains 2 rules
[ref]  
@@ -375,17 +375,17 @@
   - medium_severity
   - no_reboot_needed
   - package_audit_installed
-


-[[packages]]
-name = "auditd"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "auditd"
+version = "*"
 
Rule  
                                 Enable auditd Service
                                   [ref]
The auditd service is an essential userspace component of
@@ -467,10 +467,7 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
-


-[customizations.services]
-enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -478,6 +475,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["auditd"]
 
Group  
                 GRUB2 bootloader configuration
                           Group contains  1 rule
[ref]  
@@ -560,7 +560,109 @@
 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
 configuration, user authentication, and other such information. Log files should be
 protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
Identifiers and References
References: 
-            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal
CPE Platforms
  • cpe:/o:debian:debian_linux:10
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
Checklist
Group  
                 Guide to the Secure Configuration of Debian 10
                           Group contains 11 groups and 24 rules
Group  
@@ -96,7 +96,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -129,33 +144,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -188,21 +203,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 Configure Syslog
                           Group contains 1 group and 4 rules
[ref]  
@@ -250,17 +250,17 @@
   - medium_severity
   - no_reboot_needed
   - package_syslogng_installed
-


-[[packages]]
-name = "syslog-ng"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "syslog-ng"
+version = "*"
 
Rule  
                                 Enable syslog-ng Service
                                   [ref]
The syslog-ng service (in replacement of rsyslog) provides syslog-style logging by default on Debian.
@@ -293,10 +293,7 @@
   - medium_severity
   - no_reboot_needed
   - service_syslogng_enabled
-


-[customizations.services]
-enabled = ["syslog-ng"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -304,6 +301,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["syslog-ng"]
 
Rule  
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides
@@ -321,17 +321,17 @@
   - medium_severity
   - no_reboot_needed
   - package_rsyslog_installed
-


-[[packages]]
-name = "rsyslog"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "rsyslog"
+version = "*"
 
Rule  
                                 Enable rsyslog Service
                                   [ref]
The rsyslog service provides syslog-style logging by default on Debian 10.
@@ -364,10 +364,7 @@
   - medium_severity
   - no_reboot_needed
   - service_rsyslog_enabled
-


-[customizations.services]
-enabled = ["rsyslog"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -375,6 +372,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["rsyslog"]
 
Group  
                 File Permissions and Masks
                           Group contains 2 groups and 12 rules
[ref]  
@@ -415,7 +415,8 @@
                                 Verify Group Who Owns group File
                                   [ref]
 To properly set the group owner of /etc/group, run the command: 
$ sudo chgrp root /etc/group
Rationale:
The /etc/group file contains information regarding groups that are configured
 on the system. Protection of this file is important for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
Identifiers and References
References: 
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleProfile for ANSSI DAT-NT28 Restrictive Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive
CPE Platforms
  • cpe:/o:debian:debian_linux:10
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Debian 10
                           Group contains 22 groups and 49 rules
Group  
@@ -165,7 +165,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -198,33 +213,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -257,21 +272,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 System Accounting with auditd
                           Group contains 2 rules
[ref]  
@@ -375,17 +375,17 @@
   - medium_severity
   - no_reboot_needed
   - package_audit_installed
-


-[[packages]]
-name = "auditd"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "auditd"
+version = "*"
 
Rule  
                                 Enable auditd Service
                                   [ref]
The auditd service is an essential userspace component of
@@ -467,10 +467,7 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
-


-[customizations.services]
-enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -478,6 +475,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["auditd"]
 
Group  
                 Configure Syslog
                           Group contains 3 groups and 8 rules
[ref]  
@@ -539,7 +539,109 @@
 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
 configuration, user authentication, and other such information. Log files should be
 protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
Identifiers and References
References: 
-            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleStandard System Security Profile for Debian 10
Profile IDxccdf_org.ssgproject.content_profile_standard
CPE Platforms
  • cpe:/o:debian:debian_linux:10
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Debian 10
                           Group contains 19 groups and 44 rules
Group  
@@ -251,17 +251,17 @@
   - medium_severity
   - no_reboot_needed
   - package_audit_installed
-

-[[packages]]
-name = "auditd"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "auditd"
+version = "*"
 
Rule  
                                 Enable auditd Service
                                   [ref]
The auditd service is an essential userspace component of
@@ -343,10 +343,7 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
-


-[customizations.services]
-enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -354,6 +351,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["auditd"]
 
Group  
                 Configure Syslog
                           Group contains 2 groups and 6 rules
[ref]  
@@ -415,7 +415,109 @@
 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
 configuration, user authentication, and other such information. Log files should be
 protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
Identifiers and References
References: 
-            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	# From each of these files extract just particular log file path(s), thus:
+	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
+	# * Ignore empty lines,
+	# * Strip quotes and closing brackets from paths.
+	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
+	# * From the remaining valid rows select only fields constituting a log file path
+	# Text file column is understood to represent a log file path if and only if all of the
+	# following are met:
+	# * it contains at least one slash '/' character,
+	# * it is preceded by space
+	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
+	# Search log file for path(s) only in case it exists!
+	if [[ -f "${LOG_FILE}" ]]
+	then
+		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
+		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")
+		FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")
+		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
+		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
+		# Since above sed command might return more than one item (delimited by newline), split
+		# the particular matches entries into new array specific for this log file
+		readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS"
+		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
+		# items from newly created array for this log file
+		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
+		# Delete the temporary array
+		unset ARRAY_FOR_LOG_FILE
+	fi
+done
+
+# Check for RainerScript action log format which might be also multiline so grep regex is a bit
+# curly:
+# extract possibly multiline action omfile expressions
+# extract File="logfile" expression
+# match only "logfile" expression
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	ACTION_OMFILE_LINES=$(grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
+	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
+	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
+done
+
+# Ensure the correct attribute if file exists
+FILE_CMD="chgrp"
+for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
+do
+	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
+	if [ -z "$LOG_FILE_PATH" ]
+	then
+		continue
+	fi
+	$FILE_CMD "4" "$LOG_FILE_PATH"
+done
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Ensure Log Files Are Owned By Appropriate Group - Set rsyslog logfile configuration
     facts
   ansible.builtin.set_fact:
     rsyslog_etc_config: /etc/rsyslog.conf
@@ -610,7 +712,29 @@
   - medium_severity
   - no_reboot_needed
   - rsyslog_files_groupownership
-

# Remediation is applicable only in certain platforms
+
Rule  
+                                Ensure Log Files Are Owned By Appropriate User
+                                  [ref]
The owner of all log files written by
+rsyslog should be
+
+adm.
+
+These log files are determined by the second part of each Rule line in
+/etc/rsyslog.conf and typically all appear in /var/log.
+For each log file LOGFILE referenced in /etc/rsyslog.conf,
+run the following command to inspect the file's owner:
+
$ ls -l LOGFILE

+If the owner is not
+
+adm,
+
+run the following command to
+correct this:
+
+
$ sudo chown adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
+configuration, user authentication, and other such information. Log files should be
+protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_ownership
Identifiers and References
References: 
+            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2

# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # List of log file paths to be inspected for correct permissions
@@ -698,7 +822,7 @@
 done
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleProfile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_average
CPE Platforms
  • cpe:/o:debian:debian_linux:11
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Debian 11
                           Group contains 20 groups and 45 rules
Group  
@@ -165,7 +165,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -198,33 +213,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -257,21 +272,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 Configure Syslog
                           Group contains 3 groups and 8 rules
[ref]  
@@ -333,7 +333,109 @@
 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
 configuration, user authentication, and other such information. Log files should be
 protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
Identifiers and References
References: 
-            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	# From each of these files extract just particular log file path(s), thus:
+	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
+	# * Ignore empty lines,
+	# * Strip quotes and closing brackets from paths.
+	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
+	# * From the remaining valid rows select only fields constituting a log file path
+	# Text file column is understood to represent a log file path if and only if all of the
+	# following are met:
+	# * it contains at least one slash '/' character,
+	# * it is preceded by space
+	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
+	# Search log file for path(s) only in case it exists!
+	if [[ -f "${LOG_FILE}" ]]
+	then
+		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
+		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")
+		FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")
+		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
+		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
+		# Since above sed command might return more than one item (delimited by newline), split
+		# the particular matches entries into new array specific for this log file
+		readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS"
+		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
+		# items from newly created array for this log file
+		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
+		# Delete the temporary array
+		unset ARRAY_FOR_LOG_FILE
+	fi
+done
+
+# Check for RainerScript action log format which might be also multiline so grep regex is a bit
+# curly:
+# extract possibly multiline action omfile expressions
+# extract File="logfile" expression
+# match only "logfile" expression
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	ACTION_OMFILE_LINES=$(grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
+	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
+	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
+done
+
+# Ensure the correct attribute if file exists
+FILE_CMD="chgrp"
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleProfile for ANSSI DAT-NT28 High (Enforced) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_high
CPE Platforms
  • cpe:/o:debian:debian_linux:11
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Debian 11
                           Group contains 23 groups and 50 rules
Group  
@@ -165,7 +165,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -198,33 +213,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -257,21 +272,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 System Accounting with auditd
                           Group contains 2 rules
[ref]  
@@ -375,17 +375,17 @@
   - medium_severity
   - no_reboot_needed
   - package_audit_installed
-


-[[packages]]
-name = "auditd"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "auditd"
+version = "*"
 
Rule  
                                 Enable auditd Service
                                   [ref]
The auditd service is an essential userspace component of
@@ -467,10 +467,7 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
-


-[customizations.services]
-enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -478,6 +475,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["auditd"]
 
Group  
                 GRUB2 bootloader configuration
                           Group contains  1 rule
[ref]  
@@ -560,7 +560,109 @@
 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
 configuration, user authentication, and other such information. Log files should be
 protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
Identifiers and References
References: 
-            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal
CPE Platforms
  • cpe:/o:debian:debian_linux:11
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
Checklist
Group  
                 Guide to the Secure Configuration of Debian 11
                           Group contains 11 groups and 24 rules
Group  
@@ -96,7 +96,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -129,33 +144,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -188,21 +203,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 Configure Syslog
                           Group contains 1 group and 4 rules
[ref]  
@@ -250,17 +250,17 @@
   - medium_severity
   - no_reboot_needed
   - package_syslogng_installed
-


-[[packages]]
-name = "syslog-ng"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "syslog-ng"
+version = "*"
 
Rule  
                                 Enable syslog-ng Service
                                   [ref]
The syslog-ng service (in replacement of rsyslog) provides syslog-style logging by default on Debian.
@@ -293,10 +293,7 @@
   - medium_severity
   - no_reboot_needed
   - service_syslogng_enabled
-


-[customizations.services]
-enabled = ["syslog-ng"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -304,6 +301,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["syslog-ng"]
 
Rule  
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides
@@ -321,17 +321,17 @@
   - medium_severity
   - no_reboot_needed
   - package_rsyslog_installed
-


-[[packages]]
-name = "rsyslog"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "rsyslog"
+version = "*"
 
Rule  
                                 Enable rsyslog Service
                                   [ref]
The rsyslog service provides syslog-style logging by default on Debian 11.
@@ -364,10 +364,7 @@
   - medium_severity
   - no_reboot_needed
   - service_rsyslog_enabled
-


-[customizations.services]
-enabled = ["rsyslog"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -375,6 +372,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["rsyslog"]
 
Group  
                 File Permissions and Masks
                           Group contains 2 groups and 12 rules
[ref]  
@@ -415,7 +415,8 @@
                                 Verify Group Who Owns group File
                                   [ref]
 To properly set the group owner of /etc/group, run the command: 
$ sudo chgrp root /etc/group
Rationale:
The /etc/group file contains information regarding groups that are configured
 on the system. Protection of this file is important for system security.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_file_groupowner_etc_groupIdentifiers and References
References: 
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html	2023-06-15 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Restrictive Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive

CPE Platforms

  • cpe:/o:debian:debian_linux:11

Revision History

Current version: 0.1.68

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 11   Group contains 22 groups and 49 rules
Group   @@ -165,7 +165,22 @@

When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References

References:  - BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158



Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -198,33 +213,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+

Rule   + Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD +   [ref]

The sudo NOPASSWD tag, when specified, allows a user to execute +commands using sudo without having to authenticate. This should be disabled +by making sure that the NOPASSWD tag does not exist in +/etc/sudoers configuration file or any sudo configuration snippets +in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they +do not have authorization. +

+When operating systems provide the capability to escalate a functional capability, it +is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References

References:  + BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-

Rule   - Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD -   [ref]

The sudo NOPASSWD tag, when specified, allows a user to execute -commands using sudo without having to authenticate. This should be disabled -by making sure that the NOPASSWD tag does not exist in -/etc/sudoers configuration file or any sudo configuration snippets -in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they -do not have authorization. -

-When operating systems provide the capability to escalate a functional capability, it -is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References

References:  - BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158


Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -257,21 +272,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
Group   System Accounting with auditd   Group contains 2 rules
[ref]   @@ -375,17 +375,17 @@ - medium_severity - no_reboot_needed - package_audit_installed -


-[[packages]]
-name = "auditd"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "auditd"
+version = "*"

Rule   Enable auditd Service   [ref]

The auditd service is an essential userspace component of @@ -467,10 +467,7 @@ - medium_severity - no_reboot_needed - service_auditd_enabled -


-[customizations.services]
-enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -478,6 +475,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["auditd"]
Group   Configure Syslog   Group contains 3 groups and 8 rules
[ref]   @@ -539,7 +539,109 @@ 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownershipIdentifiers and References

References:  - BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


Complexity:low
Disruption:medium
Strategy:configure
- name: Ensure Log Files Are Owned By Appropriate Group - Set rsyslog logfile configuration
+            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2

# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html	2023-06-15 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Debian 11
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:debian:debian_linux:11

Revision History

Current version: 0.1.68

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 11   Group contains 19 groups and 44 rules
Group   @@ -251,17 +251,17 @@ - medium_severity - no_reboot_needed - package_audit_installed -

-[[packages]]
-name = "auditd"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
+


+[[packages]]
+name = "auditd"
+version = "*"

Rule   Enable auditd Service   [ref]

The auditd service is an essential userspace component of @@ -343,10 +343,7 @@ - medium_severity - no_reboot_needed - service_auditd_enabled -


-[customizations.services]
-enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -354,6 +351,9 @@
     ensure => 'running',
   }
 }
+


+[customizations.services]
+enabled = ["auditd"]
Group   Configure Syslog   Group contains 2 groups and 6 rules
[ref]   @@ -415,7 +415,109 @@ 
$ sudo chgrp adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_groupownershipIdentifiers and References

References:  - BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2


Complexity:low
Disruption:medium
Strategy:configure
- name: Ensure Log Files Are Owned By Appropriate Group - Set rsyslog logfile configuration
+            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2

# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+# List of log file paths to be inspected for correct permissions
+# * Primarily inspect log file paths listed in /etc/rsyslog.conf
+RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
+# * And also the log file paths listed after rsyslog's $IncludeConfig directive
+#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
+readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
+readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
+readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
+
+# Declare an array to hold the final list of different log file paths
+declare -a LOG_FILE_PATHS
+
+# Array to hold all rsyslog config entries
+RSYSLOG_CONFIGS=()
+RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
+
+# Get full list of files to be checked
+# RSYSLOG_CONFIGS may contain globs such as
+# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
+# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
+RSYSLOG_CONFIG_FILES=()
+for ENTRY in "${RSYSLOG_CONFIGS[@]}"
+do
+	# If directory, rsyslog will search for config files in recursively.
+	# However, files in hidden sub-directories or hidden files will be ignored.
+	if [ -d "${ENTRY}" ]
+	then
+		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
+		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
+	elif [ -f "${ENTRY}" ]
+	then
+		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
+	else
+		echo "Invalid include object: ${ENTRY}"
+	fi
+done
+
+# Browse each file selected above as containing paths of log files
+# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	# From each of these files extract just particular log file path(s), thus:
+	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
+	# * Ignore empty lines,
+	# * Strip quotes and closing brackets from paths.
+	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
+	# * From the remaining valid rows select only fields constituting a log file path
+	# Text file column is understood to represent a log file path if and only if all of the
+	# following are met:
+	# * it contains at least one slash '/' character,
+	# * it is preceded by space
+	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
+	# Search log file for path(s) only in case it exists!
+	if [[ -f "${LOG_FILE}" ]]
+	then
+		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
+		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")
+		FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")
+		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
+		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
+		# Since above sed command might return more than one item (delimited by newline), split
+		# the particular matches entries into new array specific for this log file
+		readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS"
+		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
+		# items from newly created array for this log file
+		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
+		# Delete the temporary array
+		unset ARRAY_FOR_LOG_FILE
+	fi
+done
+
+# Check for RainerScript action log format which might be also multiline so grep regex is a bit
+# curly:
+# extract possibly multiline action omfile expressions
+# extract File="logfile" expression
+# match only "logfile" expression
+for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
+do
+	ACTION_OMFILE_LINES=$(grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
+	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
+	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
+done
+
+# Ensure the correct attribute if file exists
+FILE_CMD="chgrp"
+for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
+do
+	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
+	if [ -z "$LOG_FILE_PATH" ]
+	then
+		continue
+	fi
+	$FILE_CMD "4" "$LOG_FILE_PATH"
+done
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Ensure Log Files Are Owned By Appropriate Group - Set rsyslog logfile configuration
     facts
   ansible.builtin.set_fact:
     rsyslog_etc_config: /etc/rsyslog.conf
@@ -610,7 +712,29 @@
   - medium_severity
   - no_reboot_needed
   - rsyslog_files_groupownership
-

# Remediation is applicable only in certain platforms
+
Rule  
+                                Ensure Log Files Are Owned By Appropriate User
+                                  [ref]
The owner of all log files written by
+rsyslog should be
+
+adm.
+
+These log files are determined by the second part of each Rule line in
+/etc/rsyslog.conf and typically all appear in /var/log.
+For each log file LOGFILE referenced in /etc/rsyslog.conf,
+run the following command to inspect the file's owner:
+
$ ls -l LOGFILE

+If the owner is not
+
+adm,
+
+run the following command to
+correct this:
+
+
$ sudo chown adm LOGFILE
Rationale:
The log files generated by rsyslog contain valuable information regarding system
+configuration, user authentication, and other such information. Log files should be
+protected from unauthorized access.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_rsyslog_files_ownership
Identifiers and References
References: 
+            BP28(R46), BP28(R5), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001314, 4.3.3.7.3, SR 2.1, SR 5.2, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-10.5.1, Req-10.5.2, 10.3.1, 10.3.2

# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # List of log file paths to be inspected for correct permissions
@@ -698,7 +822,7 @@
 done
/usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
@@ -33,7 +33,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 10
       This guide presents a catalog of security-relevant
 configuration settings for Debian 10. It is a rendering of
@@ -76,14 +76,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -91,9 +91,9 @@
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -101,49 +101,50 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -151,26 +152,24 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -181,19 +180,20 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -2046,11 +2046,6 @@
   - no_reboot_needed
   - package_aide_installed
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   include install_aide
 
 class install_aide {
@@ -2059,6 +2054,11 @@
   }
 }
 
+                  
+[[packages]]
+name = "aide"
+version = "*"
/usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml	2023-06-15 00:00:00.000000000 +0000
@@ -33,7 +33,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 10
       This guide presents a catalog of security-relevant
 configuration settings for Debian 10. It is a rendering of
@@ -76,14 +76,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -91,9 +91,9 @@
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -101,49 +101,50 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -151,26 +152,24 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -181,19 +180,20 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -2046,11 +2046,6 @@
   - no_reboot_needed
   - package_aide_installed
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   include install_aide
 
 class install_aide {
@@ -2059,6 +2054,11 @@
   }
 }
 
+                  
+[[packages]]
+name = "aide"
+version = "*"
/usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml	2023-06-15 00:00:00.000000000 +0000
@@ -7,892 +7,874 @@
     2023-06-15T00:00:00
   
   
-    
-      Disable support for /proc/kkcore
-      
-        ocil:ssg-kernel_config_proc_kcore_action:testaction:1
-      
-    
-    
-      Ensure System Log Files Have Correct Permissions
-      
-        ocil:ssg-rsyslog_files_permissions_action:testaction:1
-      
-    
-    
-      Kernel panic timeout
-      
-        ocil:ssg-kernel_config_panic_timeout_action:testaction:1
-      
-    
-    
-      Enable Use of Strict Mode Checking
+    
+      Ensure Log Files Are Owned By Appropriate User
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-rsyslog_files_ownership_action:testaction:1
       
     
-    
-      Disable x86 vsyscall emulation
+    
+      Ensure auditd Collects File Deletion Events by User - rmdir
       
-        ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1
+        ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1
       
     
-    
-      Ensure auditd Collects File Deletion Events by User - renameat
+    
+      Verify User Who Owns Backup passwd File
       
-        ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1
+        ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1
       
     
-    
-      Disable Kerberos Authentication
+    
+      Ensure All Accounts on the System Have Unique Names
       
-        ocil:ssg-sshd_disable_kerb_auth_action:testaction:1
+        ocil:ssg-account_unique_name_action:testaction:1
       
     
-    
-      Ensure No World-Writable Files Exist
+    
+      Enable checks on scatter-gather (SG) table operations
       
-        ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1
+        ocil:ssg-kernel_config_debug_sg_action:testaction:1
       
     
-    
-      Ensure SMEP is not disabled during boot
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Verify Group Who Owns group File
+    
+      Ensure logrotate is Installed
       
-        ocil:ssg-file_groupowner_etc_group_action:testaction:1
+        ocil:ssg-package_logrotate_installed_action:testaction:1
       
     
-    
-      Add nosuid Option to /dev/shm
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Remove the OpenSSH Server Package
+    
+      Account Lockouts Must Be Logged
       
-        ocil:ssg-package_openssh-server_removed_action:testaction:1
+        ocil:ssg-accounts_passwords_pam_faillock_audit_action:testaction:1
       
     
-    
-      Unmap kernel when running in userspace (aka KAISER)
+    
+      Restrict Virtual Console Root Logins
       
-        ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1
+        ocil:ssg-securetty_root_login_console_only_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Verify that Shared Library Files Have Restrictive Permissions
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-file_permissions_library_dirs_action:testaction:1
       
     
-    
-      Configure Sending and Accepting Shared Media Redirects by Default
+    
+      Audit Configuration Files Must Be Owned By Root
       
-        ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1
+        ocil:ssg-file_ownership_audit_configuration_action:testaction:1
       
     
-    
-      Disable Accepting Packets Routed Between Local Interfaces
+    
+      Disable RDS Support
       
-        ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1
+        ocil:ssg-kernel_module_rds_disabled_action:testaction:1
       
     
-    
-      The Chrony package is installed
+    
+      Record Events that Modify the System's Mandatory Access Controls in usr/share
       
-        ocil:ssg-package_chrony_installed_action:testaction:1
+        ocil:ssg-audit_rules_mac_modification_usr_share_action:testaction:1
       
     
-    
-      Verify Permissions on passwd File
+    
+      Record Attempts to Alter Logon and Logout Events - faillock
       
-        ocil:ssg-file_permissions_etc_passwd_action:testaction:1
+        ocil:ssg-audit_rules_login_events_faillock_action:testaction:1
       
     
-    
-      Verify Ownership on SSH Server Public *.pub Key Files
+    
+      Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
       
-        ocil:ssg-file_ownership_sshd_pub_key_action:testaction:1
+        ocil:ssg-sudo_remove_no_authenticate_action:testaction:1
       
     
-    
-      Kernel panic oops
+    
+      Sign kernel modules with SHA-512
       
-        ocil:ssg-kernel_config_panic_on_oops_action:testaction:1
+        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
       
     
-    
-      Set SSH MaxSessions limit
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sshd_set_max_sessions_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      Configure auditd max_log_file_action Upon Reaching Maximum Log Size
+    
+      Record Events that Modify the System's Discretionary Access Controls - lsetxattr
       
-        ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1
       
     
-    
-      Ensure the audit Subsystem is Installed
+    
+      Ensure Rsyslog Authenticates Off-Loaded Audit Records
       
/usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Debian 10
   This guide presents a catalog of security-relevant
 configuration settings for Debian 10. It is a rendering of
@@ -43,14 +43,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
+    
       
-        
-          
-        
-        
-          
-        
+        
+      
+    
+    
+      
+        
       
     
     
@@ -58,9 +58,9 @@
         
       
     
-    
+    
       
-        
+        
       
     
     
@@ -68,49 +68,50 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -118,26 +119,24 @@
         
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
-        
-      
-    
-    
-      
-        
+        
+          
+        
+        
+          
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -148,19 +147,20 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
   
@@ -2013,11 +2013,6 @@
   - no_reboot_needed
   - package_aide_installed
 
-              
-[[packages]]
-name = "aide"
-version = "*"
-
               include install_aide
 
 class install_aide {
@@ -2026,6 +2021,11 @@
   }
 }
 
+              
+[[packages]]
+name = "aide"
+version = "*"
+
/usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml	2023-06-15 00:00:00.000000000 +0000
@@ -33,7 +33,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 11
       This guide presents a catalog of security-relevant
 configuration settings for Debian 11. It is a rendering of
@@ -76,14 +76,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -91,9 +91,9 @@
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -101,49 +101,50 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -151,26 +152,24 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -181,19 +180,20 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -2046,11 +2046,6 @@
   - no_reboot_needed
   - package_aide_installed
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   include install_aide
 
 class install_aide {
@@ -2059,6 +2054,11 @@
   }
 }
 
+                  
+[[packages]]
+name = "aide"
+version = "*"
/usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml	2023-06-15 00:00:00.000000000 +0000
@@ -33,7 +33,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 11
       This guide presents a catalog of security-relevant
 configuration settings for Debian 11. It is a rendering of
@@ -76,14 +76,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-              
-            
-            
-              
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -91,9 +91,9 @@
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -101,49 +101,50 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -151,26 +152,24 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
-            
-          
-        
-        
-          
-            
+            
+              
+            
+            
+              
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -181,19 +180,20 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -2046,11 +2046,6 @@
   - no_reboot_needed
   - package_aide_installed
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   include install_aide
 
 class install_aide {
@@ -2059,6 +2054,11 @@
   }
 }
 
+                  
+[[packages]]
+name = "aide"
+version = "*"
/usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml	2023-06-15 00:00:00.000000000 +0000
@@ -7,892 +7,874 @@
     2023-06-15T00:00:00
   
   
-    
-      Disable support for /proc/kkcore
-      
-        ocil:ssg-kernel_config_proc_kcore_action:testaction:1
-      
-    
-    
-      Ensure System Log Files Have Correct Permissions
-      
-        ocil:ssg-rsyslog_files_permissions_action:testaction:1
-      
-    
-    
-      Kernel panic timeout
-      
-        ocil:ssg-kernel_config_panic_timeout_action:testaction:1
-      
-    
-    
-      Enable Use of Strict Mode Checking
+    
+      Ensure Log Files Are Owned By Appropriate User
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-rsyslog_files_ownership_action:testaction:1
       
     
-    
-      Disable x86 vsyscall emulation
+    
+      Ensure auditd Collects File Deletion Events by User - rmdir
       
-        ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1
+        ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1
       
     
-    
-      Ensure auditd Collects File Deletion Events by User - renameat
+    
+      Verify User Who Owns Backup passwd File
       
-        ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1
+        ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1
       
     
-    
-      Disable Kerberos Authentication
+    
+      Ensure All Accounts on the System Have Unique Names
       
-        ocil:ssg-sshd_disable_kerb_auth_action:testaction:1
+        ocil:ssg-account_unique_name_action:testaction:1
       
     
-    
-      Ensure No World-Writable Files Exist
+    
+      Enable checks on scatter-gather (SG) table operations
       
-        ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1
+        ocil:ssg-kernel_config_debug_sg_action:testaction:1
       
     
-    
-      Ensure SMEP is not disabled during boot
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Verify Group Who Owns group File
+    
+      Ensure logrotate is Installed
       
-        ocil:ssg-file_groupowner_etc_group_action:testaction:1
+        ocil:ssg-package_logrotate_installed_action:testaction:1
       
     
-    
-      Add nosuid Option to /dev/shm
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Remove the OpenSSH Server Package
+    
+      Account Lockouts Must Be Logged
       
-        ocil:ssg-package_openssh-server_removed_action:testaction:1
+        ocil:ssg-accounts_passwords_pam_faillock_audit_action:testaction:1
       
     
-    
-      Unmap kernel when running in userspace (aka KAISER)
+    
+      Restrict Virtual Console Root Logins
       
-        ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1
+        ocil:ssg-securetty_root_login_console_only_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Verify that Shared Library Files Have Restrictive Permissions
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-file_permissions_library_dirs_action:testaction:1
       
     
-    
-      Configure Sending and Accepting Shared Media Redirects by Default
+    
+      Audit Configuration Files Must Be Owned By Root
       
-        ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1
+        ocil:ssg-file_ownership_audit_configuration_action:testaction:1
       
     
-    
-      Disable Accepting Packets Routed Between Local Interfaces
+    
+      Disable RDS Support
       
-        ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1
+        ocil:ssg-kernel_module_rds_disabled_action:testaction:1
       
     
-    
-      The Chrony package is installed
+    
+      Record Events that Modify the System's Mandatory Access Controls in usr/share
       
-        ocil:ssg-package_chrony_installed_action:testaction:1
+        ocil:ssg-audit_rules_mac_modification_usr_share_action:testaction:1
       
     
-    
-      Verify Permissions on passwd File
+    
+      Record Attempts to Alter Logon and Logout Events - faillock
       
-        ocil:ssg-file_permissions_etc_passwd_action:testaction:1
+        ocil:ssg-audit_rules_login_events_faillock_action:testaction:1
       
     
-    
-      Verify Ownership on SSH Server Public *.pub Key Files
+    
+      Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
       
-        ocil:ssg-file_ownership_sshd_pub_key_action:testaction:1
+        ocil:ssg-sudo_remove_no_authenticate_action:testaction:1
       
     
-    
-      Kernel panic oops
+    
+      Sign kernel modules with SHA-512
       
-        ocil:ssg-kernel_config_panic_on_oops_action:testaction:1
+        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
       
     
-    
-      Set SSH MaxSessions limit
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sshd_set_max_sessions_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      Configure auditd max_log_file_action Upon Reaching Maximum Log Size
+    
+      Record Events that Modify the System's Discretionary Access Controls - lsetxattr
       
-        ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1
       
     
-    
-      Ensure the audit Subsystem is Installed
+    
+      Ensure Rsyslog Authenticates Off-Loaded Audit Records
       
/usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml	2023-06-15 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Debian 11
   This guide presents a catalog of security-relevant
 configuration settings for Debian 11. It is a rendering of
@@ -43,14 +43,14 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
+    
       
-        
-          
-        
-        
-          
-        
+        
+      
+    
+    
+      
+        
       
     
     
@@ -58,9 +58,9 @@
         
       
     
-    
+    
       
-        
+        
       
     
     
@@ -68,49 +68,50 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -118,26 +119,24 @@
         
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
-        
-      
-    
-    
-      
-        
+        
+          
+        
+        
+          
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -148,19 +147,20 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
   
@@ -2013,11 +2013,6 @@
   - no_reboot_needed
   - package_aide_installed
 
-              
-[[packages]]
-name = "aide"
-version = "*"
-
               include install_aide
 
 class install_aide {
@@ -2026,6 +2021,11 @@
   }
 }
 
+              
+[[packages]]
+name = "aide"
+version = "*"
+
RPMS.2017/scap-security-guide-redhat-0.1.68-0.0.noarch.rpm RPMS/scap-security-guide-redhat-0.1.68-0.0.noarch.rpm differ: byte 225, line 1
Comparing scap-security-guide-redhat-0.1.68-0.0.noarch.rpm to scap-security-guide-redhat-0.1.68-0.0.noarch.rpm
comparing the rpm tags of scap-security-guide-redhat
--- old-rpm-tags
+++ new-rpm-tags
@@ -809,13 +809,13 @@
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-C2S.html ebc835962159f35f498e572ed75eb827dd2e824cc5284918ea91a7f522f2e308 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_enhanced.html ba02262dd99609f14383277660b05a101ed710d1737f24637ead2396a20ba62c 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_high.html 9f8ffea4f05e730037816088763cdea941d8a60b586b73c98be1e410f332e15b 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_intermediary.html 40476ca27198467c801b0fe080808e71338c1e535dcb5544577f8e6f64fee6fa 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_minimal.html 42e3b72e473b77321132961765383307b7bc5c34497c4b6305faf04d2ce8d52c 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis.html f6fef02b2bb2db2a8b373515cb19078c3c231d7bcd5f5518d7b0e566231fc0f8 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis_server_l1.html c016f3769ea5e39060b6e49bd1acb1acba294c9d66966926d65923f892804af1 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis_workstation_l1.html f19c48502f64a30ca36bb964f02d6a29ac43f78be04d7e1329e55072648315ad 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis_workstation_l2.html 5361af33081673a20d05fcf9431deb1ffc560659e3db03e3229c48f57519017b 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cjis.html 140e86345194b8fd528962f66b0362364140ec54736e12af8d95aefb0e81de0c 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cui.html e03b03be6a84459899fe1113b85e27647116872465319dc9832ea48dacee8f45 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-e8.html 91e9926b6f83f5fe3aba62c01ea38db55d37b3801401dcc8b09bc56d57fee5df 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-hipaa.html 9525aa44346bf1594ad5434f79d5d8d438932701c54ba4ce131035971b62e7f2 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-C2S.html 1f03067ad6a91db63508e995b38cdcc611c8e988937ac697812fe88e30254ad4 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_enhanced.html 0cbe6120e023a30ed2544cbcf780d1dd12f2010d2cbe4fd58c572e93233e98d2 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_high.html 6685a88bfe8ea7da6b7889017c8b19c48873742b92f2c92f63cb6a0367abf53a 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_intermediary.html 9ec9b10555c9492bd737ac75a10441bb0db8e061e0c880653877192cdac7a190 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_minimal.html 001207462d3d7512b16cae77473d3c8ee90f16e3b80f864cd4056a2afa47a58b 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis.html 3c54ae27b6ba216853ac820c0bd0d11bebd27e0b80d6225a20f6b796c05a452b 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis_server_l1.html 6507e2224e2b3fafce3ad048ea852fc74ecafddd525f55459605f2ca0f2fd8dc 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis_workstation_l1.html 2aad00a2efacd76f47ad822d6a2f799e0064e080cee4158754913c0ce0f23e0b 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis_workstation_l2.html 06d94cc2dbb36b63a91b9f3aef19444fa6ac0dca735980bb4be2a1ac8da56d93 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cjis.html 930682471e6615ec596516d715d739402d8104544618017ea2ea340443982168 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cui.html 0696c8549a7dd4fd37d829bbf5f54d6909f0de212db5acc31ba571259069510a 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-e8.html 88efa9a19f605c02c706f2499fcfffd80931b0d2f67a5d68b3467049daa496db 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-hipaa.html 3ffdf17663e055490b24ba9d4d7fd93fff6ded78a4b815d7fbd88e6aa25a34e6 2
@@ -823,21 +823,21 @@
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-ncp.html 3e8778cffa88839072d77032dc3d0972f2240d59ef5d0c2f0cba446af04b490d 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-ospp.html 4add5087ac427acee6b8a0dac370d43f3102538588b72610ab9450cc25bedb8d 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-pci-dss.html c4e590ce2653b5f68accefdd956cb282cad1b0d38f30f0f4a275c1385bec9bc3 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-rhelh-stig.html 5ed468124607a29ab43ae75237132b05f779062d9ba6c2400628ac1645ad9350 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-rhelh-vpp.html 00eb6d5fd32d65382387ffe238dd008edeb4f071d12fbc921f0c1df4e66a0408 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-rht-ccp.html ff39ee2c56579978a365768ee26dadb3754d8ad94e108d69b4189fe61d90e052 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-standard.html 8978875bb745bd9d5fdeaabdd81487066f704b76407be478f5e768c9acdddaf8 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-stig.html 81b7ce789b9f46896865ba4d9676d3487e938a08c1cf7c7221965ad239217f8f 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-stig_gui.html 57995f653d62ca7d3e70af45d3e7175f991904a6536d2285774f4c8651ce17aa 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_enhanced.html cac90897f358c0ff58102c982c0614c130367727f3cc1414584e7126c769791e 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_high.html ccf99d3be4795d574993cb5ccfc5d703329c6ff8facc3562e2d126949847712d 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_intermediary.html 5cc9dc741dfe86abbc255fb360cf75874c8b368ee3f1f0b837d7c915ecfcca21 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_minimal.html 90a511bc95c3460c4d6c79b15348466bdda05aa6bf35dbf35f9623cea0479593 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis.html 5e27f29294f31232567dcf54dc885ade50e8da3a7389b1c7546b74864adcf7fe 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_server_l1.html 61a26b4fa71fcae9ca87f6f2c0ef1fcaf957a5cc3c5bd354951b67a63ec0698f 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l1.html ff5f0f72a08cb2809f04e31f0548a4ad3d42cb6b04472ce8fc443fb118385fc6 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l2.html 72032ad656148ff5ba301ab2cee4a580a7c4ad51efa968b0e8821f65d30679cc 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cjis.html 012dd339829a6685fed5245ff0d06d65c316582ca0e75fe08bebd01259694455 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cui.html b656befd64aa637257237b5b17d20b1e11c5c6b5811c25e310dd4558d13e8d04 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-e8.html 010d83e46d034154a3f72b46a4eb37e6662edc73e6436725df1f487b18d44805 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-hipaa.html 348aa177702f2671b929a76f6ed4066ceaea8f2c90794676b04a7cb79c23fbff 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-ncp.html 32450d3b563f1c1556144b13d8d47229436cd465f9bbf0d60106b4036bf97bf8 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-ospp.html 8a415cc40762b7b355ae7266c1802135be3adae3f1c589ac0a717ac2c630e809 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-pci-dss.html 3a9b75c643eed4564fbe1f06053b21abc17fc1ab619c706fff196f8d7bf1a5e8 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-rhelh-stig.html 64fee985033dc2da0ee55fb31f774e6cde94ed9dd2489e5c67f12f30d198b043 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-rhelh-vpp.html 81e3edfb82f4b7ac04a0ba36ee05e134fc51defd891fa3b2db9b7071834c27da 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-rht-ccp.html 8b524ab8f28a3c5b6762388bc34b6c14c135b612a2ee7cb844b19e48c45204d5 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-standard.html 8a1198d3e5f78dca6318be52554e5e48cd98b0f31f3143a10ebce070933b480e 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-stig.html cc5e59a62dcf51375a69ded629a89cc61f51122bf2517ee58e5edff783d32629 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-stig_gui.html 80ae62078e439aa36ecea103849e8ba51a7cd000f8a49a27d48bfb525c1e80f3 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_enhanced.html 595e0fce3fca4607467474c9f3f9fa6e8662034e58059ea46a13a2522e72f127 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_high.html cde299bb53032c29f97e37dbc4bf10d0a2940f1cefdda82f0ece20e835557994 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_intermediary.html bcc33364d359b7d7ec60761ad08dab5a84d1e84963fa28b5e7d230eed9a535a1 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_minimal.html 218a1f98ab31909611e7e6888bd8c812d15a083149b6de235ed23581ad5fd7c6 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis.html 34815f9e1129a0c81733e1f0ac4cd96a48568ec04bbfc0101b24874a270b734a 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_server_l1.html 4b3d68e3a51a854eff4be93f8365193ba203522d074a13ef95c4e476f3e98b4b 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l1.html 0b60a9794b6dac4eec267b3e7b4fb8eb0a63bc110dad838ef5854e33eae776cb 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l2.html 37d7d5d8733a7de8241be1a9117e4fd62f2feb40a55a0863d55874baae0f369f 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cjis.html 1d487ed749e363d587c90e9c9b2fc2628f1b1863c61a2c3466631eb4b7473ca6 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cui.html 3a62f00e31e4e031c18ac785a98e65a006fda8697aedc2b418c5f071f896d707 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-e8.html 0abd8e4e49999251f54cbe8e8e568c5f39066615115bc191d5c732dda07889bd 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-hipaa.html 6d9dc8536522025c626568b4401821500ffc5bfd9497aac3212f15cfccc638d2 2
@@ -845,18 +845,18 @@
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ism_o.html a317fe75ba664b831d8228e4338153cbfff3e6530e87df6c86c13922ec0d719d 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ospp.html d224915074977c464060704e7615d5d3662a493da0c07606f14312b01720b82e 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-pci-dss.html dd09df4ec8e9e4ce2610ca4e49bbfa8c06e963da7c490898df4faa189790981f 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-rht-ccp.html 7787be09ac7ee879a4e3d9fc40f57b12843bbc88fc8163057c6a14dfea2e7c20 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-standard.html ea7b6dff20850a72cc1269337bc71b6bb4ebdfc663796fface079abcf2466ccf 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig.html 53a03ac42544c6707a6ab30df9134b0f032f67874d9da40bb797257b2286595a 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig_gui.html 325bc8bbd3e1465c4b59b6caf8a8430db7c1b6d36db9a4de0b1f76bee9379015 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_enhanced.html ce1313a23bdc0c1c2c967feab6417ab27c5f9439ca68a1826d7fa54e6a3da04b 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_high.html e98a79a198abd905dd9568f7828b5b92e2112f70a94624aec39f6250ac939739 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_intermediary.html 499ecc56f311efa2dd706370b6a853d6c42e97116a36c30a8501a15126604dfd 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_minimal.html ef5c6b32db783c9462eb69f3101c7a72ef412b03b268a7b23a1679cc77105183 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis.html 2ae2f460c52853d5fc76473cbb878ce12e9454cb9a51260792adbd7ede12de18 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_server_l1.html cdbd6b8883da077c670f84fb95feafdc556ffadb916092ce671152224b4567e0 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l1.html 87ed906e7073968b27d2a3ef164e5f5d1cd1f144d1f14c8dc9baab6e85f6c527 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l2.html 850f722dd0dfc5c268ad150f95280b9c9e444798f8282550a49de6f5ff8e8d6c 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cui.html c672588ef6d82ac2f47d88769830ac6839bd146f3dc2e842b28412d2cb476064 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-e8.html bcd514ea2943ce0c15e28db271c46cfb1ad353aca7bfde868ab5e79ad31cd5e4 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-hipaa.html 909f70585b23686a4ac2bc3fe648f2c6f267681589cd794da712d6ad1520eb28 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ism_o.html 5716e273ca5468a265942c0d3440ba5bbf84c506aedc81cb4b12165de9fb1113 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ospp.html e4217947fa5aa0282b2e23a1f00a6149b7a891b385fec5531047866b231d23cb 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-pci-dss.html ed723a78183fbd3f7cbddec762452c94950e330e83133cb8b545e95c7a98611c 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-rht-ccp.html 3d72b63ec0c0f0bbcf5a8b9ef2984b34398f0986c9efee2e4c055b949bc769c5 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-standard.html 7b127c10c2708e38e35a1426abbb55e1821180b7fd964438648814f535f57617 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig.html 36356321d03a367a8c2ec92c99b9ad66a69cccc92c7464230daa2c869533969c 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig_gui.html a3cb013756354b7d411625b0d476569a97395bda55f73e67789c182e421bddb8 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_enhanced.html 156bf7cb702aa44a0fc3dfea27ec9f9d97f5f9f5deb6437658476b7926cc87b9 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_high.html d0bb5bd4d281132dd0bda095c65d02cffdbeab9a9c0d53449c3e9d8c5b77925a 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_intermediary.html 3a18c5711e2bbb6779542fc0b5ca75a9fd24530b9f5db96498c641c6f1581eca 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_minimal.html 70823f73488a41de26d8ed7c4d14eff83b6819012d4059b4f274c8c932ae49a3 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis.html 0319f93b2401bc9c1975048e2b969de6621db9dd2da653e50a07777aee41a5e1 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_server_l1.html de5a915784c0753e6fc46c0b9c4bef68dadea725cc575a937bd2539f320a885c 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l1.html c654db67cfb3e39046436c4324d74db5e4dca56087b335adfe434940c6b8af05 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l2.html a7d7638ff1778df33261e0f8b09b50327887472721e5c0619d08d374f02a02a6 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cui.html f9b7e53977621f6633fc8634a9457027003f5c8b52dbece7190eea61e7853cb5 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-e8.html 6857854c3d6e0afef8ec12f8af99c8949c981d93e9ad2def53f78474c515ea87 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-hipaa.html eb0b3a22f34bf6a433225d8c3ade171416dbe48ccd3aa37834894497b30c52a4 2
@@ -864,6 +864,6 @@
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ism_o.html eea38ddacd9ad057a84153921756e04c53134976fa6f541f3ffb8dcfa040f9b7 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ospp.html f717f7135538bfc7bd247550273abe9b45e22663ddb22c7293ed65ff230ad499 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-pci-dss.html 6756e0c32983a070ccf1e602445e3450bcb95dee13728d363b141af046def2b4 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig.html 0a7a535b110d9068e1e8bcda383709f24a98a9d8eb666e59451a33bcd91826f7 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig_gui.html 2307446eff3cd3cedc1a74ea8cb31d01d038c43c03130a39115a4f12d3eee7b9 2
-/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-cusp_fedora.html 848b818a6624151c470bdaa2f542ebda4f29c8c02ad0eb26f1ac61b2babc4dbd 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ism_o.html eb5e63a9631dc1be5b4bd85d0d233a7605580be772e1432cca3eee9ed00baa01 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ospp.html 6f1464bb52915cb6ebf58dba0c4a4a7993ac571bc8c7e1398b8fd915279303b9 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-pci-dss.html 380703a9cc0147e2be5887e4019f22e044d0484e67e0b1bb0e980ef1bcb07831 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig.html 2be02f890654fc205cb3ade17d0c25e03af7451d2a4021f276a51052be7f59fb 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig_gui.html adebacf71ba3388661ddb1e688f7fe8260534d72ef51d06823930ec6df945a27 2
+/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-cusp_fedora.html 5c4fd23374b7829b1e897031a0c0ca70078ba3b04d7caffdec24a7694a96b429 2
@@ -871,11 +871,11 @@
-/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-ospp.html 62ac792557eef540bd394076cda51a2ba995dfb478cd7615ed76d3382299da9a 2
-/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-pci-dss.html 6dc203a5c77d76e1d551c971296db78b39447e0ab1aff06664d6fe21c8e323f5 2
-/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-standard.html 54beb72bd487d31e15cce43c475449ab4d48c36f975f6e1643ade472a0d10ad3 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_enhanced.html 1c3b3d6a3042ff442a8c00fc1e1e47a3801e634c7a2a11378f2a021a28b03ba8 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_high.html a85ed5cb16825b784bd9035ca54c93fbd4f25d3b4b7e1fe5fb43713766614e1f 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_intermediary.html 9a5287647cf65c249183af501244ead8b503d8a705ef7a63e99b9991a5d629b4 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_minimal.html 29e7e2600f4057f9b4082589f8580f3dc4d236a40deb268012c5474a187dce17 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cjis.html 9e082c2364941eb4162356923996f6c174992b6376a5f01df56d43f4e2099d3c 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cui.html e1de6a743660af86d42aeb02603663a792ac92fa42872ed0af73fcccd6332aa9 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-e8.html 9d91bc0d861c77a91a035d5826e8cb3dc3a41f7527ffe1fbeaa1cbc1e713fcad 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-hipaa.html 636e65c61aab083d358c88588b8a7350aeb838baf6db37de73e3b4664b971551 2
+/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-ospp.html dea0d1c317b91814b583190b5623c36acf2db2031d0f26e61d9022d9f7d25b9d 2
+/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-pci-dss.html 643c084de8781806fcd6c03ff54b2d27e6ee8317d4513f12161e023f157d8d19 2
+/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-standard.html bfb8a0f58514bed1ee0767eeb965c3a86b52382484201eb5bf82bb2d90f564bb 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_enhanced.html e3eeed6913acf4d0e7ab2f73c90bcb680e427b29f1e7dc121663ce8519b27c08 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_high.html 21fac37a1887f4724886a5050f159554546a89fb57ea2100e7b708e0666d362e 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_intermediary.html 1e478505f487f8e08198f05d5a0a6c491d68040f68ca29e1b3d42857d2def3e2 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_minimal.html 535ce604acdc3e22fab25bb91b27fffdade2c62972f8b0aeec71936a5aefa9ee 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cjis.html 39fed2fb251815bbff5699b51b093d27575e2d1e1ad129415a12f29c16a38b39 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cui.html 3019a6045061ae25941f01b8c1fefe9051c073b7b8b0f9a9a729e4c1eb8a568d 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-e8.html 0363c8cdea00822f69618d54bd66104f241f60627e05a8e53a7c1f2a6ef0f13b 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-hipaa.html 935d1f70854a29aec8ce50ac455ce5ce5432fffc735177e526bc4f29aa91b4d2 2
@@ -883,15 +883,15 @@
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ncp.html b3743f7c1b569886d44d310ad37d3423144ce79aca6462336010fd4e5d884dad 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ospp.html a67e5f43be3b9a9310810cafdbbc5065b8be21be0c88f3da086e2b4a87da26d3 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-pci-dss.html e1e4d3cee6ab4083951abdcff3369d5b23894b189075f5f1eb5e844f8256917e 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-sap.html 7b5d2cd7f8d67ac9786fb44a03da6c0edde5568a5b7a746383b2b21acafae0d3 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-standard.html d28fe7a692895e228f315d38336d57a9fabd5883cc24ed9b4ab88ef9a1505adb 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig.html 1cb2d44e5bf8cb99e0a88aa948a0cc262f8a946a76345cd9cad8cd637f5ac5fa 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig_gui.html 34d74d6b5092e767b1e2d1b5e92fb08b0aec2d19d7ffd987c33e8eb71b8dabc4 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_enhanced.html 23a530e58936e9e56d6d497ce594b5b08686910540d234ca613c4c85f8a15f32 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_high.html d25880cd309437c8e9a14e91b00163b4700fff6effb2988aa108ae3c78709dd8 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_intermediary.html 7ee61ec55cf4dcf46f6bc95a64dd696bf121e44e85d659330b730da107ea02e8 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_minimal.html a8465de86ace01b15189662e0bb748216d4d2a50f65bc161c26f365fe52e266e 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cjis.html b0fb80178557dad568e579eda720d232b1c20819c5dc606c21a4cfaa5762f9a8 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cui.html 6572528766f8ea650d1c9610931bd01d4cf22aceddf399627c763539b65baa7c 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-e8.html c8e2daeeb274df4b440ca4a0a3e1920ee6ea8c609c6431466c10fcf2097c47a5 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-hipaa.html 30873ac772ecafbce07ecce6c8957fd400fa12bd0b5fb4cf77a00f526033b885 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ncp.html 601ccdbb36bb4b486a93d8f57adccec530c6c5d8ee9f099ffa10a047c374a9ae 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ospp.html 6ade3249a118d1dd3c931710c5443c6cc40e53614cee67f6b17c103b263a99bc 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-pci-dss.html 440c8d56a9ebd0e54711f301906c597339eb2ff87d8d945ff8783c729143adde 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-sap.html 4e441d05cac25620869a3e18077a81839c8079f6643e1cc706ce7ddca9cc57b3 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-standard.html c3d9e85ad1af93bcc56fce36ffd77d73231cf89791765cab4155dfdb18044c2b 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig.html 44932a7c497ec826a44d7d5bb865ee0f70eb76974d6d0424a49e26526b28e9cd 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig_gui.html 70d986313b3e0fb21d385076b2f0ad4cabe64b9910400eedeb9416f2bb245ff2 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_enhanced.html 10ee3b68a31fc18469bbe11673b98b50514f092d9077b0baaa1afc0702bb1141 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_high.html 309f4d200fc8ae1bf8c7d268dc0b770d99f15f667ecc9b6947e4f34f7aa64d39 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_intermediary.html 9334cc6da491dafc40144a19fecfba17dfa777372c9227a1d8e945a199c8f7d3 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_minimal.html 0979a480dab2d52b082fb31e264c3085c52db6b28268cb9b2b30dcd327823a78 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cjis.html a3b72fde649e2af75d7ef71e63a6a8634ff1e4cee0ec0cad648eb9fe59690236 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cui.html 37f833deff85e7baa4fe7c7dd5497911a784bdea105b7d0a47acd3d57218f646 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-e8.html 1dcf1da7b47683bdb480bca31c3c127e5e7364971e8b8909bf644727a6a91b53 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-hipaa.html 972deff6cadf6ab0b81a4454d58f6a35cb680ffe534afa8d81e63e2192c6f6de 2
@@ -899,12 +899,12 @@
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-ospp.html 67924768f679a02dcf1f661e9827cde47326fefd43f9eac65b6815de7b2148ff 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-pci-dss.html 3a6666b71988ade5e5531b84fec1fd281fdbea0824dcba2df8ba9ede009737ba 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-standard.html f824c86612572c9e34154df2777e6cb71d7601034fc0faee8a37ecc0835c71d6 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig.html 0b9bca6ee8270fc727daa626f7d48fa36cf174d311b528ba3459064570237b91 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig_gui.html 16bcc865fae35a0e1a7a3b346df707e6b6e02e52b4f61ad23162de8f8466408a 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_enhanced.html e74c9999bd0079fcf2ed36739fbf35c75849d3f1da2942404a66944e4e7580f2 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_high.html 46564a5f39ed5e684dece6ff3b5a125fa5a545e0c6ba6266764b7c7043297604 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_intermediary.html 655c40e9ee17ad03d581aa2bfaeb8d50da3b83a7499b239cc6bbad027c722bef 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_minimal.html 512621811e0257fb9ed65579569afb0c9b9c1430676c58a43f5097f45acccafc 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-cui.html 8c0592e399d1465e57887ca1a87a9275507cc60239d4553a7365b0c022ad5b83 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-e8.html 2d491fd105e3558c7714cdfa62ab9294e6f2e2f6560b03c82b14a677b998e97d 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-hipaa.html b793a19a573562561440981778553155891144106d049f92261dcb7577fec9d3 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-ospp.html ab377c49bf576f8292d4d47c5972166b2f8b01d7029569af0069f5ec21a1d40c 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-pci-dss.html 5f4861253d7893ce3d07561e551512fcbbbcfeeff24df3507b98e6e6ad96d59a 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-standard.html 2f59b0ad39fac28113a2f32e93703167c0d68ceb8b6845c1ae95b88ff6f23eb8 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig.html 9fb973c7c43a52d8db0751c4e826017de3c3e1ebf8ed717491e0a043f127e1dd 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig_gui.html 768f33b8b4ebf845739d1348377229d9e941a5e884933c153d18e047270fdc46 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_enhanced.html d477ec183a399fc30c2b288e30db052aa155ef5e0572eb0444c41cd821852f1d 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_high.html a91a98b8130b14b8618487fb896f6a2bc9ee9f096cf1626849b3062c1fbddbdd 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_intermediary.html 8fead0729c06f20b12a6907a4cc1fc4bc5fe110c0e3527d692c6cbd6d206432b 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_minimal.html 0d587d6a688f0cbbec093bf4d386811744e722fb7715480f186ad18a543594ba 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-cui.html 3bbb54b9800d251b27cdf2fc0dc89fc3ab2216edb6b3dacc6ae3d439a9fe8f7b 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-e8.html 333a928f964fdfa44e412d2448a548b0abd5571aa1f019ca0205caa8074d9e18 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-hipaa.html 690272d099e3b2fc5ea0c683214c039aababa777e3e1405ae23e8828f93ae8e9 2
@@ -912,11 +912,11 @@
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-ospp.html a29b15e18ffbb90cd5638943050ecd15932bdcf67ebefff6beb07849f16ace7e 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-pci-dss.html 75a8fbcd6d12b1d55b88cbc291e32eb64fd9f126fae1e1c6fb71d72bb3927ae4 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-standard.html 75c688df3047ce67a238aeb6dc5b006f444e7a5768a56ecf3f8e27242946d937 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig.html a2f36a3bde63f39ec5ea0f2b378ca2d75e5351bcfdb71d77bc0da50e85087e19 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig_gui.html fb4a18a2b53bca45d68f2a45591d0de978db94580f69e03d2339e35759c4b17e 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_enhanced.html f741e69bcfe51562ced6fb6ef65def75fddc4e0612733167bd594b978c74bd75 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_high.html 69cb12196023f43850286ae9d8bf6d0e14c11d04d6644a2c768f26db19fd322e 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_intermediary.html dcf9831898bb65d38b73048e0e16c275d5919c5dcbf2f168e4cfd23790db27fc 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_minimal.html 49838f8161fa9e78373f3ce1591bab6bddb63e932c98808e61a2f2f7adaf054e 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-e8.html 4dbcecabe6c8f9ed4be8b1f8ca0d9abc6b3ccc9a7480e180692d119fe395cfd4 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-high.html 033f4349efc29349ed9e9807e5838507cf1aab1c7b9d2aa6967d7baf5a74c222 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-ospp.html 8c2bf79a5b24c01b2d464cdce93d2c52465afb2e0b714e09224b3703957c03da 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-pci-dss.html e3831daf1728d0ec647ba0ec2bcfbec77acd62881892b2ab3c0574c6ceaee023 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-standard.html 763b8b48994f2bbd0513a7851c647b4a96e00e4639b35ec3c5a8ebea0fd561c7 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig.html 413294de8ea6ab2aa5e491e52cbe173cb2afad1755706c42f23dc7cdfe480e95 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig_gui.html b593a20f265fadf3ad7ff2ee8fb8a39d427ef4f117d7c9934001cc6b62b2177f 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_enhanced.html df12aa6557adaa24817cfac157619f3b00b4832ddbf4a0e6e5ac44e3166de2ec 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_high.html 064589ddf405b4c23de31c6da3a4b744de0f954d17dbade624dcf37921c5bf46 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_intermediary.html d831e1f145024a8cb6d6c564cc6151a7e9c4a436219755be71c3fd4a6024e578 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_minimal.html b864375c787e06eecbf783afe9fa61033c27c0ca3305832357232d9926ec33d3 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-e8.html 528271f14b339c1cecbe39e30dee21de6b1e2dc1d6dab1e3119f649b3afd7326 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-high.html 03ca84c912d819ebc494ec2a58c629767c608c1be008b41ce42205f7dad43e80 2
@@ -924,15 +924,15 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-moderate.html 00aa20bfaa600b35ed81e3cb6d3a13437e7e309dde1170794b85223fc27edde6 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-nerc-cip.html e11d714abf3e1331d4f901bda08d2a25dead198d07910f08bcb46226dc7d185f 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-C2S.html 543781a8b8ffeef4b871a37edd033ce28499b33ba63d99587a386674992874fd 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_enhanced.html 93468442324b8a0acba7b129a98f5cf4574d021026b4c984cdc7f2e363608b81 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_high.html 9a9e3a570c46a9aef5dba3f7522191a0ee7db0b72460a17222ab3ed9493ed7d2 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_intermediary.html 8960a5e8055f30118753e07e2312368dac4896b8ec29a01131342c27fa556cec 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_minimal.html 76411a4995abfb7348166d939fbf779adf1c25b18ba419fd91cebd4748cd7ada 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis.html f4fd232e5d305663cd36b1420750178d1db4b308ae05d6df6dccd5afca5b8802 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_server_l1.html e3ff278a69641aad619307db18cd85d193173a2624ee5528fd6e217c551937c2 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l1.html 8324c6b128ef11b68f492b5f024a381fd1351c9b578deee22820529fab3d3ef8 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l2.html f8969553bcfbb1265e12f81efd72a7986c253110c7531bbfe0882b94460f7bb8 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cjis.html 99c726330bf0360ae582b43bbb3cab72b83f1d2cc7fe8b0f2c6700fc719491a0 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cui.html fe954db3b2e5c997fc41924d2c7e196fe1648789b4df3aaa1217dcfd5704b7ae 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-e8.html 37e998a386947aa22cc4085b96044af159a65a6f69a79c820bb73a4b16134481 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-hipaa.html 72e933cb3114002eef8e6aa77d63603d6f2b61a8a5a99af434d3fc4bc059cc72 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-moderate.html b1908b31b764aa5844cc8775d3c1bd1262150fe8905bb8f844b33f4a2c729685 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-nerc-cip.html 292c7a024392aa7402ecabe84902eebd2f7118683e4933dfde3777d070adb723 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-C2S.html 1ceb5b16aa85b2218b89f09cccf47aa50d192490cc0f632eada7f02c3a958187 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_enhanced.html 5bf90839cbb399da00f0e04ea14b83955ec4f641ac30819e8064118764a7daaa 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_high.html bbc9f7a329dca6b4b7007a2cf205f5aacb48ea483dd588cc7cdc2dec3327154b 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_intermediary.html 22c72b593d3f6487b878a3787cbe4aacd9bfefa03bbf123cda73a179699a9e18 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_minimal.html 79bc2d16a34ddf01e38178b1640ac7264306c5f0292353974b873e6941d1d54f 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis.html 2aa5ac457b54ed8892d60140aae7de0ab77d61ac3efeb38b9b9c2c18432e0a65 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_server_l1.html 783899e690e729be238201d0ede18ca2a2028480a997fc790d1d37cc25e3fe11 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l1.html 9a4e84f3c35d23f232b584213403bed2b72ba8de2dde909dd52a6b53bbe0f05d 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l2.html ee01ac91a0616c67c0c9a3a99bfa05244931bc05a5aa4f4810f43859781769e0 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cjis.html 0d135662d5a5dfc72973b1cacc38c1f68603ccce6e44e256948e05fd92870267 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cui.html 6fd5812ec45cd6ad79f61a35081646802af18a7497c4988119794588af9c1f4a 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-e8.html 55c86e41021ef4e9a0f66f64e30740cdcd518bfc555f932fc809b95aa0a3fa67 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-hipaa.html 99c6d6108c5317ad770449a7150dcbb4bd379e09c14edae10d3f470506c66888 2
@@ -940,21 +940,21 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ncp.html d5578bed1f5ed355b3ca3a4598990ecc37477d569dd4f76e012878b696172bd2 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ospp.html 668d12e7fc848f15d055d886f27c90a22a48e5470958ea208c78f55aae837874 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-pci-dss.html 6ea906e4c87b22376fcfa70ed8afd24038658f8dc2283467a6381ebedd2b51b5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-stig.html bd421cc5b98616ce6a8fd2b434bfff927552ab8e04f4a7c82ca256aaa69a1ca3 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-vpp.html 5121a6bcb6e81e6f5457936344576086714808d8b58a3f4ea9f2d6b57fd94b5f 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rht-ccp.html 8e6edc12f634851c2a7a13862ab4ee244dbe0c4a9b56190bac09e1acd58f5de5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-standard.html a46ce9a50738d48907a5f44cf49fe365d1b4c94cb6e508ecfb7651c028caaa21 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig.html db19906ee548af8539ea9a4c6cd71b80c63a484d4614f0b0aa70ded6fbfd6501 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig_gui.html 72ef89b5b2f466621c76fa3ee4328c0a22c79bdb67d498d0720cd869d964d46c 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_enhanced.html f77235491c1ab5ec94831ac24b82a9a4d93e33ae7d91eccf002eabbd85d83a19 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_high.html 108df212817879f92fc89227603ff408d347472d507cd7e66df9a9cb2abd5535 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_intermediary.html df30cdd9da464012d7eb1d7c6f9cdc19ba79dbabe028a8dff189dcc9129d16a1 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_minimal.html 79445a464f3cb17d993dd3de310b72847af6753d6903fc4f72784e9d32ef1bd7 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis.html 87ef30682d845fca4cd910a3d8b390debd180b82897a12c1e53138fdb2fe115a 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_server_l1.html d177e25e9f7246b057328760246a35eea3c7b7f7610d753887f9ef5db59d750c 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l1.html 44a2638a87a60337468281f8dd490394dbe1f57f95b8250d106d41604af9cc43 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l2.html a74cb95171262e3041149fb2c5301c9eedf8a411ea1efe8c92515065bdebf771 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cjis.html a7fc6df15c5daa2a92f495819f2322db0d90b2f5b7b5f55993624e46f575a6bb 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cui.html e71be9dcb1da4565d1865bae67a38b0848f9fad7c3e5189694e020eb8d1112b5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-e8.html a075b155e59285e0290c219587a4ca9ab9f3c394b954c4851d50f56697d91769 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-hipaa.html eec6e6d5cf18db7d1ed3d153e2c7124251c7ff99b45a03744df9af2c3034e050 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ncp.html 350c64f98a05b72ec27d16ffbd072a9277b2f9dd080e933c204dd420772e12b9 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ospp.html 4af8ac931123bddd6ae67c176d577774e84e8832d2c9e78a583ac984e803b70b 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-pci-dss.html e80a91555156091b371b072950725b04716df92daa5db14b0620def02a425512 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-stig.html d721f123d319aacbaf3dbe77d672ec9a87f036ed87fe5498a1b010f70bd9818e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-vpp.html f7f989fe9c5b412741816d1f628c282904de418499e2d97c1fbad6c70382bea0 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rht-ccp.html a517ff78302d648d9525c8f7f7b289ac6ee29b26dd36afb622a710fc4c7bb4c6 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-standard.html acc71637987ed7f8b0e38a8a5a018a5e2a1757cf7b4d169c95f58b73ec9fee23 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig.html e4ddd68ce989f8ff996da0223264b4df78f0ac29c2b584705187129197234678 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig_gui.html fe55584ddb13997726d9840db8ec2a882de4cdabe97c5a2d9a32f371c95d9052 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_enhanced.html c1bbd6d84836ce545faad4df95e2c7799e046b2c3b7458c291558cd69ee3661b 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_high.html 5d0d5e50c4dc3aab0eee13b4d54714779f95533b64c42415c5b887946353a068 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_intermediary.html 7f7a64462d2b7e9c2ed591a31f1a53cf14f96b985a0cb18a3a821e8d6942f5b5 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_minimal.html 536308e352660a689e4dc2443a8150c6b63b5c7fb8593f47ff635b94c70ebe03 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis.html fb398c8b1866f9c4e2e0dbb0c2af522898db5f86330fb7cee60be03975ee2bfc 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_server_l1.html 6ee4c6dfb9ee13e3c14a77de66b81eafe3de1e9df5fb122a9998ba6642cc8899 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l1.html bfdfb0d279bb16c4324f94bb8eb54cce6fef62f29f7a1e358e456a36a3349b8d 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l2.html 8e37bd5c96b145844c867ecb9b601fff72be66a00f1cd6824ed596061b21d612 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cjis.html 26b86b57f6b6ccb11e0b5a93a6438d071723df15c9074ce22c882f935ec99b0e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cui.html 520c50067e5fc8d0daeb80e49c6b44282e1d80dd33dc61626737a9eadd68e3cd 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-e8.html 2ca0b4fdf619ec6367d540f00e08de30b1e2fb0aa3a8636ae745b7aa905a3d61 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-hipaa.html 2d937b95b155f2e1ff045924597519979cc6d21f0c5d0aeaae5f7674d05e9e58 2
@@ -962,18 +962,18 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ism_o.html c22212125534bddbefda7d69462344c12a3818f7bd00e5102c8dad1c8c017036 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ospp.html c9e7ade8da701cae65bfd0a625cfcdb60d8b9469999bf97c8da2bfcdfdcab219 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-pci-dss.html d9b81af018e0bf0c931c0172a444c76a5913b2737c3c7d3553d88a9a12fd5de2 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-rht-ccp.html ea59fb2fced5e5a2f81e1ac9d4a0da93ab5459a8562a4f766125982995a7fcc5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-standard.html e5ad34351187165c2acdcab03b71afbb2466a5c160ba7f0085ced6eb6364c1f5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig.html 98841f89cf4d89c44864d7811af94d6a6dd8a0ed80296c829600a7c339de2b32 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig_gui.html a53c35fbf1fa296c11844df6a0ca83daab85a6e5a041877aeca49429f60c5df5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_enhanced.html a7e129a67f4dccd2c519a861472b9e2ecaae95604d3158e08be393163e790bc7 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_high.html a7e6de7726d0e11edc6e43fb1263d8eeb069b93e082c1b0e5f7440dd08b3a2af 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_intermediary.html 656d543b925892bf257d672c508226aaa2961419019f837971b75e7c8d171b87 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_minimal.html 89b6c8d65659edde1dde1e24f9726b528175019f955e35a98fc3399d51b921a8 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis.html cd617f1d1e75849968ff003aeb81dd774dcf0c2c0a0455e71cd1668bfb7096f1 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_server_l1.html 99467bde1ff84fc032f871c78f17090f4c3a14a85e30fa850433bcc70eb37bc2 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l1.html b0defa495c7ade55209ae46794d75f2be274746f2f07619d8e644cff714fa9da 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l2.html 62eba068da30c8a8b37fa68f24d4c3978f4d7133bc14345f10911b7df4ba164f 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cui.html d3ae13db384c3bab655ebce6fed8df09f19fcdfe51912ef503b02eeb8b84ac31 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-e8.html dac7cbc69c74b9de60812702f7d8be5ae087deca7643d866a16066a3f67cd251 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-hipaa.html d55dc352dd23fc351855c0ca89c1e90e1a5853f8e697c502f6c3f66e6585da1a 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ism_o.html 761c70b3ced81e6b19c39a713ea8b0578dd183000da271f71d12418a5ed62af0 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ospp.html 9fb081f06dec7510a422cbd14efab9e5366b6d6c3ced925a161827da77188d29 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-pci-dss.html 5d5dea5954162fcec35e80c687568544652e9cf2df630e8ee953da07cf3d69e1 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-rht-ccp.html 9abc48a9fb391ec0d029d973f233a3197ce5a32e73b2c44037ad3d4638990f2d 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-standard.html 7e25694a0bcd7fbb5074ce9832643c1f24c9dc61283a804effe4b2b5e09e72c2 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig.html fff6d06c6ca9fb9fa210c8ee635d8599efc2e1afda7fcd3ab556eeb5813cdb19 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig_gui.html 65198d70cb96c823323f76d68e48e1ec8655c65fb4891a53f763e1f2c02a2984 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_enhanced.html 276ee6d674c2cb2d495e6611e0960211e198c39ef3bd94f42cbdb67f3871e2cd 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_high.html fbe0dc3254cf4270b55cb0320c39fc508b631e1cbeb9420a2cac7a4d84fdeaa2 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_intermediary.html 510194a8e4abf94069ff13f9667f32aa51cd1717dc6a8fd298e464a726b0354c 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_minimal.html 09d9db67195bedf8e9f73ec0e249e15b34028352c256cc081c51fcf45625cb9e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis.html e6eb0bd9e7297f6f376c45c6e9daf6e1bfa65cbd06c746c113437afaff687b37 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_server_l1.html 7227b62f7167ee475676d98073431971205454a2529693bf371f43c85c122ff8 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l1.html 5c406ddb1963fd160baba12cfa06aad2eb29c895b08df28f5c30a82d665c2983 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l2.html ac7ae76b67e29dafb139764ba3aaf0271f375c176995d10516cb63cd5f44ff33 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cui.html feef5fe17a4cdc9e4822eeb8c33c4f82305f5af3510dfda0a9c81bf0814e0830 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-e8.html 56b9d624806560b9d36b23b77343ec9b2fe3b14a7c415e7fff564f72e5d9599f 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-hipaa.html 2da5bfe4cf5272b494c08fcff32b656c9ac3bbdf611e1d07e7df053bbad8d691 2
@@ -981,5 +981,5 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ism_o.html 4cbf2ddbe2fb60f0dc433ed27294126f83ea77119da20ef3c5b5bcd3445fd338 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ospp.html 689846e84f7b7035f606923077ebb62140ae194f4b24d460bf1c522e530a0586 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-pci-dss.html 0d3762d133de5235554c02877cade25f036b4a17b68bc082b563088ccc2daf12 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig.html a8a9677538de4894766418a6b81dc9397428ba149437f74b4d2a99cb47a30535 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig_gui.html c2433c6d93ce5a0c2a317e338ee7b35983e978712d1205e3bcf179cd0202ba5c 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ism_o.html 17a30ffc8d81256c4e953e91b557ffadfb2fdb82ccde33d587a07c8a002aae6e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ospp.html 3bc53812a84edf74f6488ed93a7978db8abb453e1ec0d98a0dac9470e2c13628 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-pci-dss.html a1ddc3e2981b17ab359c9b78df0be261c96c201840031b6bf8e9ce95e1d76745 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig.html bcb157e6a52361fefa8279efd299d8444470989a890a296d48e733210a88565c 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig_gui.html 03b89b3b3fc1b2116091ab137d9a07ae63937f94b675bc20cf42921e2c0e7d61 2
@@ -987,3 +987,3 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-pci-dss.html c1acc6349649145c69835a72bcf7af341543cd9a578829ea71df0c28e977e3f3 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-stig.html 9893b45ceb5f49131234d31d38012b66afb00b9c2018e3098bdc0010f780595d 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-vpp.html eca64ebd93cff5df37999d6f73c78fa503ca36b67bfc1149e708247e99b4e237 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-pci-dss.html 63d1f8a9335f8f7f42858b9a5d9ade4fa1451e26db59f278af0da9fe6db14af5 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-stig.html 6b1e27e61b6d55bfe242fa61b20cca2f12d446ebc010cd5e6b64e8dde0a89358 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-vpp.html 8eb3a8ec47ac896ec0bf811f72f3a20889e530407a59d0c88e98d720878ade37 2
@@ -991,2 +991,2 @@
-/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-pci-dss.html 185df3208183e56e631302168c73717f359531bdf3169f917ad75098e11ea3c2 2
-/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-standard.html 2abc7c4eb48f26ab2d826af0bd4c107462bb74949184af02a6fb6ca97c83ab77 2
+/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-pci-dss.html dc8cf0999fa404ac9e14d1f070d7089e12c75e36242a24aeea6b41f5cab2f5e2 2
+/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-standard.html 53d0a54d48086bd1c42021d6500431df370f2db36d6053007bbcafb60c276eb2 2
@@ -994,2 +994,2 @@
-/usr/share/doc/scap-security-guide/tables/table-ol7-anssirefs.html 4f1bc04b337877f2afdfe7becb87d5b024c2474df948e0522df57fec9e33d47d 2
-/usr/share/doc/scap-security-guide/tables/table-ol7-cuirefs.html ad7d5f44cab7e344a6468d32e34b41d0094ef3f112c36ca568d999b5bf337571 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-anssirefs.html 9782468e8e68c1c494c43c871795e22ec9774d624745d8485936c126e8b45a12 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-cuirefs.html 7ee8a0b32e15f39cb7b35838d5d520e23d9da5eb34a1f88f758ca8100fbde75b 2
@@ -999,3 +999,3 @@
-/usr/share/doc/scap-security-guide/tables/table-ol7-nistrefs.html 4216d3829d95c3b5390e7d1436451c7b6f6982e5f20bdff5137d6acc92409399 2
-/usr/share/doc/scap-security-guide/tables/table-ol7-ospprefs.html 7d87bfa69c6138c13235a8f5d267eef9414895d422e16100edd12c2fcb6c2119 2
-/usr/share/doc/scap-security-guide/tables/table-ol7-pcidssrefs.html 5eaed9605bf3e7fd958000f17f4881fd97dcb2f0fd092623f7a0f6f603f59bc7 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-nistrefs.html b38b6adbef50ff7b1f7e10e795a88656ba53123a60ea1f9a5802a271053249e7 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-ospprefs.html 8c1c86a7ce7ca79c17ea2a0fb0cd95a0587a143861b1e5e6929210e8cdcac32a 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-pcidssrefs.html a3b4438f39ac488b601430079ebb9f90e656838363c65e318943555b0283a5b8 2
@@ -1005,2 +1005,2 @@
-/usr/share/doc/scap-security-guide/tables/table-ol8-anssirefs.html 35e37fc31dcb81ead16d75f7dbf1f7c5b608ee179c53c60e9eefd7ec86b113da 2
-/usr/share/doc/scap-security-guide/tables/table-ol8-cuirefs.html 82569ac18363e535e117ac7dad4909d3bde7e2cbbfb97d7da47231275004757c 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-anssirefs.html 2ba01f6354dd25cc1db5c1e1d8716eaf7f9d7a9774a8349a7944eed52f9931be 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-cuirefs.html e6d3f0a40edef09ef58161ad5e6c6a805926298af25b43148a7ad9fc0a50e420 2
@@ -1010,2 +1010,2 @@
-/usr/share/doc/scap-security-guide/tables/table-ol8-nistrefs.html d81d78f9ce41a219448a635d1bc76fa5f455f6f83a665219a9f00a7afb189f14 2
-/usr/share/doc/scap-security-guide/tables/table-ol8-pcidssrefs.html 6dcc6b422affd6128a02ccc297514571480af4dd0eb6d15f41a8e2a490c091ae 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-nistrefs.html ea814c0813c35046e3a78bca9c9dea723dfab1a2bdf8d997cc89b690fde0e0c5 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-pcidssrefs.html 5c44e8a0f91aec40aa50005880aa15394d794346f889a0748bd79b8715c0b6d6 2
@@ -1016 +1016 @@
-/usr/share/doc/scap-security-guide/tables/table-rhcos4-nistrefs.html 2e7af88dee8b30741c69a162f9dc2eace1c0c944266af9c7e02d0719b7a5af73 2
+/usr/share/doc/scap-security-guide/tables/table-rhcos4-nistrefs.html b9c05580d738c7d1d16b8a5ec0f48644f79f24e2a61baad4bb4a6a2556df61c9 2
@@ -1021 +1021 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel7-anssirefs.html ac4f519e45f1bbab12b52ab6e0e69504267190eb481a321fd1adb321a532bc09 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-anssirefs.html a4f0f56102cf178139d3aef71087d0de03dd2e2b62be85021e66e1553187310b 2
@@ -1023,2 +1023,2 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel7-cisrefs.html f76f1746b9403572624d6ca2215512cc35ea3111b6e6be47fff5d7c2131c7229 2
-/usr/share/doc/scap-security-guide/tables/table-rhel7-cuirefs.html 862c7844555ea821b9b4b20c110cd17cf488f27c2d0a6d7c620085ef0d593a51 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-cisrefs.html f2d3e8d2e89faf47e12b7a53c03c35c0e97ec3a241080534622fd17ab1af2cb7 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-cuirefs.html 77eeba9e376620b930f812b1b1708ff8a2a5ddff8c3c799980a2c02aca5f7d34 2
@@ -1029,3 +1029,3 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel7-nistrefs.html 0d2456f9b049348a2f9e964ee3048053ef7b5559dbc7682631e7df3f8eb2709c 2
-/usr/share/doc/scap-security-guide/tables/table-rhel7-ospprefs.html f4739f0607c2ac900ce540ff149c43d58cadb83f8a321fb057f936511504760c 2
-/usr/share/doc/scap-security-guide/tables/table-rhel7-pcidssrefs.html 5507131e13485cbef22570a780cedc9340678226c3ea3d519b2be6e4e4ef6d09 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-nistrefs.html 35a5222ec230c0fd087b7d099f831add3d5647ba0021573091c96e601847db1d 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-ospprefs.html fa516b2cada9db547dd38be615452d283226290ceb9e0b2cd61eb06a898a155b 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-pcidssrefs.html e7e39f1454ffaf6f57dce23173bb12d1f393f3ddad3a51d6fb77b3cd9abe8d9c 2
@@ -1041 +1041 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel8-anssirefs.html a9eb61e4a7033beecc201f3bfc969c08201a83add2b54ea0f5da69a97c17f6d2 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-anssirefs.html bb1bf28a2316039fada4427a3fae1186c4a6f28365c34da1b7e6c9c259759f87 2
@@ -1043,2 +1043,2 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel8-cisrefs.html 1cb7fd32886e8a947fc92a7cf23f96eafbc47764555f88da591d514201624db4 2
-/usr/share/doc/scap-security-guide/tables/table-rhel8-cuirefs.html 7c558db10de1c7b45b97e1f147ed185df3bcf56ca57af424bf2da94a044bc544 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-cisrefs.html 75444516683d4da14168a5d1b0dbac9038d43357d361772a79759c85d92c5b8f 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-cuirefs.html bc9d9f7a517c8ef8456dd01dc628b2fe3e0290207879cadd06dccbaf806a90d2 2
@@ -1048,2 +1048,2 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel8-nistrefs.html a70e75cfbf99075bfde08288299db2eacbddcd0c40b326dd575a40647175fee7 2
-/usr/share/doc/scap-security-guide/tables/table-rhel8-pcidssrefs.html 0d395d3423ce622f3c608170082c72c5b401bfb27a3140a1081813b7d6e08054 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-nistrefs.html afad6fe9d32d1ab243c3047df8c81dbb1d704fec3c4687eab9ffb327e7b12cce 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-pcidssrefs.html 77e3622c2f8a0ab0ec35308782088e6dd5e5e6738bfc328fc3202cfcb3291e94 2
@@ -1437,2 +1437,2 @@
-/usr/share/scap-security-guide/tailoring/rhel7_stig_delta_tailoring.xml 07c13bb7f8b6ca247beb228c23f94bc68f1e1a3e6b9c36ef6948f37171cf78b0 0
-/usr/share/scap-security-guide/tailoring/rhel8_stig_delta_tailoring.xml 63a59d68d0bf2ecba3436f0d98e7ffd74844969e2970768e839e715668c6e51f 0
+/usr/share/scap-security-guide/tailoring/rhel7_stig_delta_tailoring.xml 810db7141d85e766f8a4d9b7b5a2a51abfe54195b3f57d57425356c74bdd231d 0
+/usr/share/scap-security-guide/tailoring/rhel8_stig_delta_tailoring.xml 882a7993e61740c5cc407c29d1b341881ae75b27716a614689a1376dd873d60b 0
@@ -1442,9 +1442,9 @@
-/usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml 679b6036e6dbf95bc93f02014f15808efd2647f304a1df8419349e3472c56a3e 0
-/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml a2ceadf6bfd3544768d10c38cfdf162f734782f84f2e71c5aee05f23de7bba55 0
-/usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml 53144ca2e58420fa54d31613584b573c7556a51fe577cbb738460a4d1a5d58c0 0
-/usr/share/xml/scap/ssg/content/ssg-centos8-ds-1.2.xml 72477b6dec17315f3f34ea8bd5bcccf162c103169f3e44482fdecec70129d60a 0
-/usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml 692fcfb69283f52874d5b9fc4fd9e7f7de9d060b1aff3ab6998ed419b28a4541 0
-/usr/share/xml/scap/ssg/content/ssg-centos8-xccdf.xml 7fd9b946efbee30c974a98039c13c7f1c2bed7498a33134b26d5622923d8c179 0
-/usr/share/xml/scap/ssg/content/ssg-cs9-ds-1.2.xml 67ac6229850979aba3fc7d93c9b8702c059d2b9b049eece9301fbd25c39d3114 0
-/usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml 5399aeb23c52de766a60903b57d97224bfc4e3059f7cd050534468e0883c2bce 0
-/usr/share/xml/scap/ssg/content/ssg-cs9-xccdf.xml 901e187c90aaa97a70566304cccd53554fefb1941220e09ce2355146864ef610 0
+/usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml ea82d1da5ab02e52a7b41865b12dd72f1b890038a331f90322663c93c893ce71 0
+/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml c7a4c24eb17637ba1c239d7fbf8275a17405781ad30210f7df34827017521537 0
+/usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml 5b5a9d192a285a10e06aea67c2af49cb76fa7e75a3baf6267670bb9e4d85a60b 0
+/usr/share/xml/scap/ssg/content/ssg-centos8-ds-1.2.xml cba9f6494b48f994c8d8fb5dd781273551a9d29e18a7a7e8d59aeb1d47aa2d32 0
+/usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml 2e9c126156f72c92da09957c19fa1633c0b6bf63522464400a0f3f5cf0d1a9bb 0
+/usr/share/xml/scap/ssg/content/ssg-centos8-xccdf.xml ab229ba6881c30daa2b7b9d8b8d3480002bb050d4c83f8983544ed5c2e00b12e 0
+/usr/share/xml/scap/ssg/content/ssg-cs9-ds-1.2.xml 912ea02512c9f200427c7a1b86c682456cff0101aafe2d5b684f07ed91202c20 0
+/usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml c1ce029b89ea19de0946fcd1212d9e48755d52df21e11d0aea2dd88477c08a83 0
+/usr/share/xml/scap/ssg/content/ssg-cs9-xccdf.xml 99ac894e945a01e260e50a8af8e611c290457dd2dd51dabf3abb35bcf781ed51 0
@@ -1453,3 +1453,3 @@
-/usr/share/xml/scap/ssg/content/ssg-fedora-ds-1.2.xml 5fbee6c71e51b337774353e1df35d9bf9e9b8902e90aebf7a6a01469b4b2339c 0
-/usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml 7a3ae60205974f588052958ecfd508ca9b2ee7729bc9840bafb39fa502b91b07 0
-/usr/share/xml/scap/ssg/content/ssg-fedora-ocil.xml 4a30d382c61dd7898c478023d6e868a988d69e9d99cb03e0a416f827607e00f7 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-ds-1.2.xml 24636a0366f1c7ecaffb6cf23b066dc4bf08ad5f0b010790d31da466f604cb39 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml 3243e43931baec322bef8aeb9277ea8679637713f43a7f1db4a381ebb1a4dabd 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-ocil.xml 56c1d0e2afd317c7b30e3403a36c9db23e13f6a573badc51bfe155f46e8ffec3 0
@@ -1457 +1457 @@
-/usr/share/xml/scap/ssg/content/ssg-fedora-xccdf.xml 7e400c7b74c37f307ff78bd02f14c2767749e675c864cba39b3952305f14a99c 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-xccdf.xml 2158b997c73195a262fdf31c3cd95139b7f63e4a78273c7d04a94f4577970833 0
@@ -1460,3 +1460,3 @@
-/usr/share/xml/scap/ssg/content/ssg-ol7-ds-1.2.xml ea8962cc75593079debe6d9a69108979fd1f4a91a0ee5c9c1ad71236612dba5e 0
-/usr/share/xml/scap/ssg/content/ssg-ol7-ds.xml 3668e297fc9491049af4afd8151fa0f1106559e35698de44a1115d938e5192d9 0
-/usr/share/xml/scap/ssg/content/ssg-ol7-ocil.xml 05ca9aeb337cb7d90739a306686b2329da72b28acc343d0b8f4f5547d7a6486a 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-ds-1.2.xml 57eb3393fe6121dc25f7bc22b9031c3b1e9454b2f3a143385ab7189de54c1b9c 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-ds.xml ee8bb6ae2530b577be20b7525a0cb565eb52c1a92677521d1b6e917bb8af781b 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-ocil.xml 5253c03a2e2102ab5460b539d884ee43147c717aab27ca92ad9e93d6bfdf3714 0
@@ -1464 +1464 @@
-/usr/share/xml/scap/ssg/content/ssg-ol7-xccdf.xml f73ba8d91e3c216d8770b605c6bf2b05c5e28f50264841100de298f5f90b0280 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-xccdf.xml 02b1411f55a76eb73f8c4c9770215fca78e1d3b4bcf207df6435df85f7ba0193 0
@@ -1467,3 +1467,3 @@
-/usr/share/xml/scap/ssg/content/ssg-ol8-ds-1.2.xml 8bb1a67ad72554a32a394eb5d00a0f52561be0f207eb92184311eb608251716e 0
-/usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml 3921cc5d0ac587168fc77f2efa0de7273a5cae0451c38f9b73742ddc3586d72f 0
-/usr/share/xml/scap/ssg/content/ssg-ol8-ocil.xml 21a6a2b9a1bd1a1269a15cd89018b4d856feeb3c294455cb56d74b2d58db7ffd 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-ds-1.2.xml d53b067b5d9d690c2914d93cde50d771a907a02baeff0cb39554dd01d21403ab 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml 987a126f0b8c4e501e8b3f1da53339c458eba69de9e3cf8f176d4b068dd08dd4 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-ocil.xml f3e1be297ea53b02f2aa76a71329e328f78bd5f37fd79c0036ab552d328292ba 0
@@ -1471 +1471 @@
-/usr/share/xml/scap/ssg/content/ssg-ol8-xccdf.xml 0c3488fe97f8110a6b9a70d64c9c68c0eb4b997db1aa9c677bbf79a2047acec0 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-xccdf.xml f8b90056c5de35032ef6887a103cf08718d5bb7bc75a44015b5c3409daaaf303 0
@@ -1474,3 +1474,3 @@
-/usr/share/xml/scap/ssg/content/ssg-ol9-ds-1.2.xml 718f9081feefbce382f4431018b7ab78c46fe36371ae1e55dc14154a22ccb11e 0
-/usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml 97284ca2e73b41d00a946851fc1be9cd9c73cd45aa58f04b00d9fa770f991f9b 0
-/usr/share/xml/scap/ssg/content/ssg-ol9-ocil.xml 94a69ba52ad739e93784cfcad70b7e5a45d87ce0cb3de25e7515e7a42e6a6450 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-ds-1.2.xml 9ab23756975320dfcc7eb2ac8a61746ad919d1dfcddfbab8a31d9b5a847dad7b 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml 4a94fe468f95f4eeedd579e08f4e20f3d4e48d4535a9d2ec5fcba64a74385329 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-ocil.xml b6534dae47741c8f0549d121d4fa0b9a06a1c03879b3451a42879526419db2cd 0
@@ -1478 +1478 @@
-/usr/share/xml/scap/ssg/content/ssg-ol9-xccdf.xml 43c9555d9682def01e46dccf6b1393e446de215ca88b4c3b629f1327bb8afd82 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-xccdf.xml 244737c2923d3ebaf2f33f0bbc954c77b0c7d929da11593d652998a961fadd25 0
@@ -1481,3 +1481,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds-1.2.xml 6819671fe5963c48ad7796d76c2f3d3a4d2dc6c645f4ba75f2c7b2aff1dacb5e 0
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds.xml b6db7abd3afa270b7ac845884e3a1e548b30521cd09a220cc7a3df78092d4823 0
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-ocil.xml bafbea3c381cc32c97cef1c1e3166a12d3e061f1deb33ac6ea91903c130230b6 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds-1.2.xml e2d6b69578b224393590e51a2be749b0166cb6216884a1a4c9fbedeed48a444f 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds.xml 7c81f0330ab4f50689dd71c71793d692437af0087a3c14389ee62da126e96a77 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-ocil.xml 5677ab76fba5512d77ad83905cd7991fb372b9e759de8c6572e7b2e0de04cadb 0
@@ -1485 +1485 @@
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-xccdf.xml 674769dbca45d05bfafd257c7de6f126b4b7957e3f6ad8b518d65e4b1ccfc4fb 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-xccdf.xml e025bd21e4afc6325a582b4267a58a6167099fc208cff127c9ccbdd5a48d3d56 0
@@ -1488,3 +1488,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml ae58089df3eda7d85c936b41c386733a3982027e0b394a1399230407e0d7e542 0
-/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml b1ac10c3bfe344c03b32dd89a728e0f6eb4028b03d847b67c69c5f910377d280 0
-/usr/share/xml/scap/ssg/content/ssg-rhel7-ocil.xml e3b80b66262e4875cb2af3f371807e949bc2380c33cb25adcfb068ae1ef3a734 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml c1c3bf057e21e438e2319329b7135d1f9e6746841ca97678d899f1560416363d 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml 1a9e0d1f399533370bbeb23a3aec24e03c9458472dd09f8bc6edf019887592b7 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-ocil.xml 44d88c74f732175db0598725768b124d4486f3691082517826c8be2aed1b238f 0
@@ -1492 +1492 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml f698c32e11720cdd2a960a14df051ca976b65426cccb82dd204dabe8d4c572f6 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml 896d216ba599bc639a8ffe75d666ae0bab7891b6f25ce4331e663f3ee5080931 0
@@ -1495,3 +1495,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml 81a7ae7b9e74337d886333010bb9c8aa6c5d6ed3b086d7dc802a5c9b6330588b 0
-/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml f595e010cf37cbb360af717969e265e2bc60b42bf837a1818df737a8869e3ab5 0
-/usr/share/xml/scap/ssg/content/ssg-rhel8-ocil.xml 942e9e1d9d1e979128e289fda5bbb2d419965ac912d705d07f325a6620eff17f 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml 4c58ce12eb53a67f8a34de6d63a39cfefbe22f6404dd2e0e5284e7ad51eb67b9 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 210a34bfb65e9ef6dc0bb9424392825a12e1dd0d81515535ec083823626665fa 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-ocil.xml 2219f25b28d56591e7c655b224f9fdf986e67f6d1a6d92959ea37a820f536633 0
@@ -1499 +1499 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml 2779cacf196177a971806ca35da72bf694712e86b15108f314750d544d71d04d 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml 5c3f3ac5dd69f017eb02d434639ed476ccb9b3c6a3a321b37435bb9c2016f4b3 0
@@ -1502,3 +1502,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml 7104ea26a3c57131459e57df25d799fb8087412831de3ea6ad199a0d7911533a 0
-/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml 77451e838a624140b08248b06134151396c5d04c66f403ffc3b276cdf8a509ac 0
-/usr/share/xml/scap/ssg/content/ssg-rhel9-ocil.xml bfda30f28f4bf43efbc0020598ecfee53b939da4d7609147cd966fb9a61f0b6a 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml 6a3348623a798fef00b7711b179d8866f987cfb179d53baa306a06ad144d4302 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml 20222d9299d42bdb0326798e393788c51bb63dff29041821b3a8b873389ecf76 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-ocil.xml 3346042dbbf81afd619b2d678181672d313727072f78962b35e917eea8722c30 0
@@ -1506 +1506 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel9-xccdf.xml 04710fbbf82d4532bca4b22f22cf2b563a0b1b681df5a06f9051ebe0127ea32a 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-xccdf.xml 03f8e10485d8cce7c4bab2078a64c5e276d6b2cb40ffda3ca36b0b07a3b89315 0
@@ -1509,3 +1509,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhv4-ds-1.2.xml 36d1d7565f7713a6bbc9d5a72c2bd6af236bc13f7f6bc0eb137de6ffb6ceb0e5 0
-/usr/share/xml/scap/ssg/content/ssg-rhv4-ds.xml bcdc4e61cf90da8b5ed426988a7d6be64fdf4f9957cf489b23501dd7413d57a9 0
-/usr/share/xml/scap/ssg/content/ssg-rhv4-ocil.xml f914e258e6472e34947e7eab8364c33c9d26b92219a19d23ee014f9800af7a95 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-ds-1.2.xml 06f786fe0bb860d756061163e77ca909668c315014171903112f5978d1d1338f 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-ds.xml c966300dfdf34675e96ae09f19358f4c54b46c057dd6ec704d0e1d60bd2c2b29 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-ocil.xml 8ca9b0ae4138eb9fb250dffd81ccc94083c46d08689847afe7c56476fefa329a 0
@@ -1513,4 +1513,4 @@
-/usr/share/xml/scap/ssg/content/ssg-rhv4-xccdf.xml 05be3ce8bd39891ad5b676b0a32241e3b74e4ba8342ed09471521b06924d5c87 0
-/usr/share/xml/scap/ssg/content/ssg-sl7-ds-1.2.xml a7bd5ef937d597de9239f1ad4091cd197b04d7ac04b3f6248eb10a913aab8b7d 0
-/usr/share/xml/scap/ssg/content/ssg-sl7-ds.xml 45ac94d1e4c601011977b4277c3db36e5f5701217e491790e44406b56d4a664a 0
-/usr/share/xml/scap/ssg/content/ssg-sl7-xccdf.xml 470cb4588cd1095030ece02f987d5cf008b38ccc77a1aa588f0aef31f9eef875 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-xccdf.xml 090407d0b2bcff63c64792cd16ff510afaf70c00872958baba6f4f7b89e4d9f3 0
+/usr/share/xml/scap/ssg/content/ssg-sl7-ds-1.2.xml 874397aa76f1ada31d4f42b400fe2a9e24194b44548536b83dac4b602b174898 0
+/usr/share/xml/scap/ssg/content/ssg-sl7-ds.xml 90d658b040f2d471765978f8ee076debf6fccad6a2a86e882f5b3dfbda27dd5a 0
+/usr/share/xml/scap/ssg/content/ssg-sl7-xccdf.xml 0a70110dc773d677742124d8f9dd624c47874a40ef738290da4a24cbb8ab6941 0
comparing rpmtags
comparing RELEASE
comparing PROVIDES
comparing scripts
comparing filelist
comparing file checksum
creating rename script
RPM file checksum differs.
Extracting packages
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-C2S.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-C2S.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-C2S.html	2023-06-15 00:00:00.000000000 +0000
@@ -84,7 +84,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleC2S for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_C2S
CPE Platforms
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::workstation
  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Avahi Server
    2. Base Services
    3. Cron and At Daemons
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Mail Server Software
    11. NFS and RPC
    12. Network Time Protocol
    13. Obsolete Services
    14. Print Support
    15. Proxy Server
    16. Samba(SMB) Microsoft Windows File Sharing Server
    17. SNMP Server
    18. SSH Server
    19. X Window System
Checklist
Group  
                 Guide to the Secure Configuration of Red Hat Enterprise Linux 7
                           Group contains 101 groups and 234 rules
Group  
@@ -128,7 +128,19 @@
                                   [ref]
The aide package can be installed with the following command:
 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable

+package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -145,20 +157,6 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
@@ -166,8 +164,10 @@
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-package --add=aide
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -190,7 +190,27 @@
 system. The operating system's Information Management Officer (IMO)/Information System
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, 1.3.2, SV-204445r880848_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+if ! rpm -q --quiet "crontabs" ; then
+    yum install -y "crontabs"
+fi
+
+if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -297,26 +317,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-if ! rpm -q --quiet "crontabs" ; then
-    yum install -y "crontabs"
-fi
-
-if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 6 rules
[ref]  
@@ -411,12 +411,12 @@
 mountpoint can instead be configured later.
Rationale:
Ensuring that /home is mounted on its own partition enables the
 setting of more restrictive mount options, and also helps ensure that
 users cannot trivially fill partitions used for log or audit data storage.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_home
Identifiers and References
References: 
-            BP28(R12), 12, 15, 8, APO13.01, DSS05.02, CCI-000366, CCI-001208, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.13.1.1, A.13.2.1, A.14.1.3, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, 1.1.17, SV-204493r603840_rule


Complexity:low
Disruption:high
Strategy:enable

+part /home
+


 [[customizations.filesystem]]
 mountpoint = "/home"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /home
 
Rule  
                                 Ensure /tmp Located On Separate Partition
                                   [ref]
The /tmp directory is a world-writable directory used
@@ -424,12 +424,12 @@
 logical volume at installation time, or migrate it using LVM.
Rationale:
The /tmp partition is used as temporary storage by many programs.
 Placing /tmp in its own partition enables the setting of more
 restrictive mount options, which can help protect programs which use it.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_tmp
Identifiers and References
References: 
-            BP28(R12), 12, 15, 8, APO13.01, DSS05.02, CCI-000366, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.13.1.1, A.13.2.1, A.14.1.3, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, 1.1.2, SV-204496r603261_rule


Complexity:low
Disruption:high
Strategy:enable

+part /tmp
+


 [[customizations.filesystem]]
 mountpoint = "/tmp"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /tmp
 
Rule  
                                 Ensure /var Located On Separate Partition
                                   [ref]
The /var directory is used by daemons and other system
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_enhanced.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_enhanced.html	2023-06-15 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_enhanced
CPE Platforms
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::workstation
  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Red Hat Enterprise Linux 7
                           Group contains 69 groups and 229 rules
Group  
@@ -124,7 +124,19 @@
                                   [ref]
The aide package can be installed with the following command:
 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable

+package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -141,20 +153,6 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
@@ -162,8 +160,10 @@
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-package --add=aide
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -185,7 +185,20 @@
 
$ sudo /usr/sbin/aide --check

 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+/usr/sbin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,19 +274,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-/usr/sbin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Federal Information Processing Standard (FIPS)
                           Group contains  1 rule
[ref]  
@@ -315,7 +315,21 @@
 protect data. The operating system must implement cryptographic modules adhering to the higher
 standards approved by the federal government since this provides assurance they have been tested
 and validated.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dracut-fips-aesni_installed
Identifiers and References
References: 
-            BP28(R1), 12, 15, 8, 5.10.1.2, APO13.01, DSS01.04, DSS05.02, DSS05.03, 3.13.11, 3.13.8, CCI-000068, CCI-000803, CCI-002450, 4.3.3.6.6, SR 1.13, SR 2.6, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.13.1.1, A.13.2.1, A.14.1.3, A.6.2.1, A.6.2.2, CIP-003-8 R4.2, CIP-007-3 R5.1, SC-12(2), SC-12(3), IA-7, SC-13, CM-6(a), SC-12, PR.AC-3, PR.PT-4, SRG-OS-000033-GPOS-00014, SRG-OS-000396-GPOS-00176, SRG-OS-000478-GPOS-00223


# Remediation is applicable only in certain platforms
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && ! ( [ "${container:-}" == "bwrap-osbuild" ] ) ) && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+
+if grep -q -m1 -o aes /proc/cpuinfo; then
+    if ! rpm -q --quiet "dracut-fips-aesni" ; then
+        yum install -y "dracut-fips-aesni"
+    fi
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+


+package --add=dracut-fips-aesni
+

Complexity:low
Disruption:low
Strategy:enable
- name: Check if system supports AES-NI
   command: grep -q -m1 -o aes /proc/cpuinfo
   failed_when: aesni_supported.rc > 1
   register: aesni_supported
@@ -366,20 +380,6 @@
   - medium_severity
   - no_reboot_needed
   - package_dracut-fips-aesni_installed
-

# Remediation is applicable only in certain platforms
-if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && ! ( [ "${container:-}" == "bwrap-osbuild" ] ) ) && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
-
-if grep -q -m1 -o aes /proc/cpuinfo; then
-    if ! rpm -q --quiet "dracut-fips-aesni" ; then
-        yum install -y "dracut-fips-aesni"
-    fi
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
-


-package --add=dracut-fips-aesni
 
Group  
                 Disk Partitioning
                           Group contains 10 rules
[ref]  
@@ -412,12 +412,12 @@
 be configured not to be mounted automatically with the noauto mount
 option.
Rationale:
The /boot partition contains the kernel and bootloader files.
 Access to this partition should be restricted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_bootIdentifiers and References
References: 
-            BP28(R12)


+            BP28(R12)

Complexity:low
Disruption:high
Strategy:enable

+part /boot
+


 [[customizations.filesystem]]
 mountpoint = "/boot"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /boot
 
Rule  
                                 Ensure /home Located On Separate Partition
                                   [ref]
If user home directories will be stored locally, create a separate partition
@@ -427,12 +427,12 @@
 mountpoint can instead be configured later.
Rationale:
Ensuring that /home is mounted on its own partition enables the
 setting of more restrictive mount options, and also helps ensure that
 users cannot trivially fill partitions used for log or audit data storage.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_home
Identifiers and References
References: 
-            BP28(R12), 12, 15, 8, APO13.01, DSS05.02, CCI-000366, CCI-001208, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.13.1.1, A.13.2.1, A.14.1.3, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, 1.1.17, SV-204493r603840_rule


Complexity:low
Disruption:high
Strategy:enable

+part /home
+


 [[customizations.filesystem]]
 mountpoint = "/home"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /home
 
Rule  
                                 Ensure /opt Located On Separate Partition
                                   [ref]
It is recommended that the /opt directory resides on a separate
@@ -440,12 +440,12 @@
 outside the packaging system. Putting this directory on a separate partition
 makes it easier to apply restrictions e.g. through the nosuid mount
 option.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_opt
Identifiers and References
References: 
-            BP28(R12)


Complexity:low
Disruption:high
Strategy:enable

+part /opt
+


 [[customizations.filesystem]]
 mountpoint = "/opt"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /opt
 
Rule  
                                 Ensure /srv Located On Separate Partition
                                   [ref]
If a file server (FTP, TFTP...) is hosted locally, create a separate partition
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_high.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_high.html	2023-06-15 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_high
CPE Platforms
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::workstation
  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Kernel Configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
    9. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Red Hat Enterprise Linux 7
                           Group contains 70 groups and 285 rules
Group  
@@ -124,7 +124,19 @@
                                   [ref]
The aide package can be installed with the following command:
 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable

+package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -141,20 +153,6 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
@@ -162,8 +160,10 @@
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-package --add=aide
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -185,7 +185,20 @@
 
$ sudo /usr/sbin/aide --check

 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+/usr/sbin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,19 +274,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-/usr/sbin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -296,7 +296,27 @@
 system. The operating system's Information Management Officer (IMO)/Information System
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, 1.3.2, SV-204445r880848_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+if ! rpm -q --quiet "crontabs" ; then
+    yum install -y "crontabs"
+fi
+
+if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -403,26 +423,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-if ! rpm -q --quiet "crontabs" ; then
-    yum install -y "crontabs"
-fi
-
-if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Notification of Post-AIDE Scan Details
                                   [ref]
AIDE should notify appropriate personnel of the details of a scan after the scan has been run.
@@ -441,7 +441,38 @@
 system. The operating system's Information Management Officer (IMO)/Information System
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_scan_notification
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 15, 16, 2, 3, 5, 7, 8, 9, BAI01.06, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, SR 6.2, SR 7.6, A.12.1.2, A.12.4.1, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, CM-6(a), CM-3(5), DE.CM-1, DE.CM-7, PR.IP-1, PR.IP-3, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, SV-204446r880851_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+if ! rpm -q --quiet "crontabs" ; then
+    yum install -y "crontabs"
+fi
+var_aide_scan_notification_email='root@localhost'
+
+
+CRONTAB=/etc/crontab
+CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
+
+# NOTE: on some platforms, /etc/crontab may not exist
+if [ -f /etc/crontab ]; then
+	CRONTAB_EXIST=/etc/crontab
+fi
+
+if [ -f /var/spool/cron/root ]; then
+	VARSPOOL=/var/spool/cron/root
+fi
+
+if ! grep -qR '^.*/usr/sbin/aide\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*.*@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
+	echo "0 5 * * * root /usr/sbin/aide  --check | /bin/mail -s \"\$(hostname) - AIDE Integrity Check\" $var_aide_scan_notification_email" >> $CRONTAB
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_intermediary.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_intermediary.html	2023-06-15 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_intermediary
CPE Platforms
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::workstation
  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services
    4. SSH Server
Checklist
Group  
                 Guide to the Secure Configuration of Red Hat Enterprise Linux 7
                           Group contains 55 groups and 158 rules
Group  
@@ -124,7 +124,19 @@
                                   [ref]
The aide package can be installed with the following command:
 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable

+package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -141,20 +153,6 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
@@ -162,8 +160,10 @@
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-package --add=aide
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -185,7 +185,20 @@
 
$ sudo /usr/sbin/aide --check

 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+/usr/sbin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -261,19 +274,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-/usr/sbin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Group  
                 Disk Partitioning
                           Group contains 9 rules
[ref]  
@@ -306,12 +306,12 @@
 be configured not to be mounted automatically with the noauto mount
 option.
Rationale:
The /boot partition contains the kernel and bootloader files.
 Access to this partition should be restricted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_boot
Identifiers and References
References: 
-            BP28(R12)


Complexity:low
Disruption:high
Strategy:enable

+part /boot
+


 [[customizations.filesystem]]
 mountpoint = "/boot"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /boot
 
Rule  
                                 Ensure /home Located On Separate Partition
                                   [ref]
If user home directories will be stored locally, create a separate partition
@@ -321,12 +321,12 @@
 mountpoint can instead be configured later.
Rationale:
Ensuring that /home is mounted on its own partition enables the
 setting of more restrictive mount options, and also helps ensure that
 users cannot trivially fill partitions used for log or audit data storage.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_home
Identifiers and References
References: 
-            BP28(R12), 12, 15, 8, APO13.01, DSS05.02, CCI-000366, CCI-001208, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.13.1.1, A.13.2.1, A.14.1.3, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, 1.1.17, SV-204493r603840_rule


Complexity:low
Disruption:high
Strategy:enable

+part /home
+


 [[customizations.filesystem]]
 mountpoint = "/home"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /home
 
Rule  
                                 Ensure /opt Located On Separate Partition
                                   [ref]
It is recommended that the /opt directory resides on a separate
@@ -334,12 +334,12 @@
 outside the packaging system. Putting this directory on a separate partition
 makes it easier to apply restrictions e.g. through the nosuid mount
 option.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_opt
Identifiers and References
References: 
-            BP28(R12)


Complexity:low
Disruption:high
Strategy:enable

+part /opt
+


 [[customizations.filesystem]]
 mountpoint = "/opt"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /opt
 
Rule  
                                 Ensure /srv Located On Separate Partition
                                   [ref]
If a file server (FTP, TFTP...) is hosted locally, create a separate partition
@@ -350,12 +350,12 @@
 that /srv is mounted on its own partition enables the setting of
 more restrictive mount options, and also helps ensure that
 users cannot trivially fill partitions used for log or audit data storage.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_srv
Identifiers and References
References: 
-            BP28(R12)


Complexity:low
Disruption:high
Strategy:enable

+part /srv
+


 [[customizations.filesystem]]
 mountpoint = "/srv"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /srv
 
Rule  
                                 Ensure /tmp Located On Separate Partition
                                   [ref]
The /tmp directory is a world-writable directory used
@@ -363,24 +363,24 @@
 logical volume at installation time, or migrate it using LVM.
Rationale:
The /tmp partition is used as temporary storage by many programs.
 Placing /tmp in its own partition enables the setting of more
 restrictive mount options, which can help protect programs which use it.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_tmp
Identifiers and References
References: 
-            BP28(R12), 12, 15, 8, APO13.01, DSS05.02, CCI-000366, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.13.1.1, A.13.2.1, A.14.1.3, CM-6(a), SC-5(2), PR.PT-4, SRG-OS-000480-GPOS-00227, 1.1.2, SV-204496r603261_rule


Complexity:low
Disruption:high
Strategy:enable

+part /tmp
+


 [[customizations.filesystem]]
 mountpoint = "/tmp"
 size = 1073741824
-

Complexity:low
Disruption:high
Strategy:enable

-part /tmp
 
Rule  
                                 Ensure /usr Located On Separate Partition
                                   [ref]
It is recommended that the /usr directory resides on a separate
 partition.
Rationale:
The /usr partition contains system software, utilities and files.
 Putting it on a separate partition allows limiting its size and applying
 restrictions through mount options.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_partition_for_usr
Identifiers and References
References: 
-            BP28(R12)


Complexity:low
Disruption:high
Strategy:enable

+part /usr
+


 [[customizations.filesystem]]
 mountpoint = "/usr"
 size = 5368709120
-

Complexity:low
Disruption:high
Strategy:enable

-part /usr
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_minimal.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-anssi_nt28_minimal.html	2023-06-15 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_minimal
CPE Platforms
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::workstation
  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services
Checklist
Group  
                 Guide to the Secure Configuration of Red Hat Enterprise Linux 7
                           Group contains 26 groups and 42 rules
Group  
@@ -111,7 +111,22 @@
 


 When operating systems provide the capability to escalate a functional capability, it
 is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, SV-204430r853885_rule


Complexity:low
Disruption:low
Strategy:restrict

+for f in /etc/sudoers /etc/sudoers.d/* ; do
+  if [ ! -e "$f" ] ; then
+    continue
+  fi
+  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  if ! test -z "$matching_list"; then
+    while IFS= read -r entry; do
+      # comment out "!authenticate" matches to preserve user data
+      sed -i "s/^${entry}$/# &/g" $f
+    done <<< "$matching_list"
+
+    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
+  fi
+done
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -146,33 +161,33 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_no_authenticate
-

Complexity:low
Disruption:low
Strategy:restrict

+
Rule  
+                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
+                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
+commands using sudo without having to authenticate. This should be disabled
+by making sure that the NOPASSWD tag does not exist in
+/etc/sudoers configuration file or any sudo configuration snippets
+in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
+do not have authorization.
+


+When operating systems provide the capability to escalate a functional capability, it
+is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
+            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, SV-204429r861003_rule

Complexity:low
Disruption:low
Strategy:restrict

 for f in /etc/sudoers /etc/sudoers.d/* ; do
   if [ ! -e "$f" ] ; then
     continue
   fi
-  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
+  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
   if ! test -z "$matching_list"; then
     while IFS= read -r entry; do
-      # comment out "!authenticate" matches to preserve user data
+      # comment out "NOPASSWD" matches to preserve user data
       sed -i "s/^${entry}$/# &/g" $f
     done <<< "$matching_list"
 
     /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
   fi
 done
-
Rule  
-                                Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
-                                  [ref]
The sudo NOPASSWD tag, when specified, allows a user to execute
-commands using sudo without having to authenticate. This should be disabled
-by making sure that the NOPASSWD tag does not exist in
-/etc/sudoers configuration file or any sudo configuration snippets
-in /etc/sudoers.d/.
Rationale:
Without re-authentication, users may access resources or perform tasks for which they
-do not have authorization.
-


-When operating systems provide the capability to escalate a functional capability, it
-is critical that the user re-authenticate.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd
Identifiers and References
References: 
-            BP28(R5), BP28(R59), 1, 12, 15, 16, 5, DSS05.04, DSS05.10, DSS06.03, DSS06.10, CCI-002038, 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-11, CM-6(a), PR.AC-1, PR.AC-7, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, SV-204429r861003_rule

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Find /etc/sudoers.d/ files
   find:
     paths:
     - /etc/sudoers.d/
@@ -207,21 +222,6 @@
   - no_reboot_needed
   - restrict_strategy
   - sudo_remove_nopasswd
-

Complexity:low
Disruption:low
Strategy:restrict

-for f in /etc/sudoers /etc/sudoers.d/* ; do
-  if [ ! -e "$f" ] ; then
-    continue
-  fi
-  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
-  if ! test -z "$matching_list"; then
-    while IFS= read -r entry; do
-      # comment out "NOPASSWD" matches to preserve user data
-      sed -i "s/^${entry}$/# &/g" $f
-    done <<< "$matching_list"
-
-    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
-  fi
-done
 
Group  
                 Updating Software
                           Group contains 5 rules
[ref]  
@@ -255,7 +255,35 @@
 provided by a trusted vendor. Self-signed certificates are disallowed by
 this requirement. Certificates used to verify the software must be from an
 approved Certificate Authority (CA).
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated
Identifiers and References
References: 
-            BP28(R15), 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, 6.3.3, SRG-OS-000366-GPOS-00153, 1.2.3, SV-204447r877463_rule


# Remediation is applicable only in certain platforms
+if rpm --quiet -q yum; then
+
+# Strip any search characters in the key arg so that the key can be replaced without
+# adding any search characters to the config file.
+stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^gpgcheck")
+
+# shellcheck disable=SC2059
+printf -v formatted_output "%s = %s" "$stripped_key" "1"
+
+# If the key exists, change it. Otherwise, add it to the config_file.
+# We search for the key string followed by a word boundary (matched by \>),
+# so if we search for 'setting', 'setting2' won't match.
+if LC_ALL=C grep -q -m 1 -i -e "^gpgcheck\\>" "/etc/yum.conf"; then
+    escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
+    LC_ALL=C sed -i --follow-symlinks "s/^gpgcheck\\>.*/$escaped_formatted_output/gi" "/etc/yum.conf"
+else
+    if [[ -s "/etc/yum.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/yum.conf" || true)" ]]; then
+        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/yum.conf"
+    fi
+    cce=""
+    printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/yum.conf" >> "/etc/yum.conf"
+    printf '%s\n' "$formatted_output" >> "/etc/yum.conf"
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -310,12 +338,22 @@
   - low_complexity
   - medium_disruption
   - no_reboot_needed
-

# Remediation is applicable only in certain platforms
+
Rule  
+                                Ensure gpgcheck Enabled for Local Packages
+                                  [ref]
yum should be configured to verify the signature(s) of local packages
+prior to installation. To configure yum to verify signatures of local
+packages, set the localpkg_gpgcheck to 1 in /etc/yum.conf.
Rationale:
Changes to any software components can have significant effects to the overall security
+of the operating system. This requirement ensures the software has not been tampered and
+has been provided by a trusted vendor.
+


+Accordingly, patches, service packs, device drivers, or operating system components must
+be signed with a certificate recognized and approved by the organization.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages
Identifiers and References
References: 
+            BP28(R15), 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CM-11(a), CM-11(b), CM-6(a), CM-5(3), SA-12, SA-12(10), PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153, SV-204448r877463_rule

# Remediation is applicable only in certain platforms
 if rpm --quiet -q yum; then
 
 # Strip any search characters in the key arg so that the key can be replaced without
 # adding any search characters to the config file.
-stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^gpgcheck")
+stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^localpkg_gpgcheck")
 
 # shellcheck disable=SC2059
 printf -v formatted_output "%s = %s" "$stripped_key" "1"
@@ -323,9 +361,9 @@
 # If the key exists, change it. Otherwise, add it to the config_file.
 # We search for the key string followed by a word boundary (matched by \>),
 # so if we search for 'setting', 'setting2' won't match.
-if LC_ALL=C grep -q -m 1 -i -e "^gpgcheck\\>" "/etc/yum.conf"; then
+if LC_ALL=C grep -q -m 1 -i -e "^localpkg_gpgcheck\\>" "/etc/yum.conf"; then
     escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
-    LC_ALL=C sed -i --follow-symlinks "s/^gpgcheck\\>.*/$escaped_formatted_output/gi" "/etc/yum.conf"
+    LC_ALL=C sed -i --follow-symlinks "s/^localpkg_gpgcheck\\>.*/$escaped_formatted_output/gi" "/etc/yum.conf"
 else
     if [[ -s "/etc/yum.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/yum.conf" || true)" ]]; then
         LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/yum.conf"
@@ -338,17 +376,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-
Rule  
-                                Ensure gpgcheck Enabled for Local Packages
-                                  [ref]
yum should be configured to verify the signature(s) of local packages
-prior to installation. To configure yum to verify signatures of local
-packages, set the localpkg_gpgcheck to 1 in /etc/yum.conf.
Rationale:
Changes to any software components can have significant effects to the overall security
-of the operating system. This requirement ensures the software has not been tampered and
-has been provided by a trusted vendor.
-


-Accordingly, patches, service packs, device drivers, or operating system components must
-be signed with a certificate recognized and approved by the organization.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages
Identifiers and References
References: 
-            BP28(R15), 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CM-11(a), CM-11(b), CM-6(a), CM-5(3), SA-12, SA-12(10), PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153, SV-204448r877463_rule

Complexity:low
Disruption:medium
- name: Gather the package facts
+

Complexity:low
Disruption:medium
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -405,34 +433,6 @@
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis.html	2023-06-15 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-cis.html	2023-06-15 00:00:00.000000000 +0000
@@ -79,7 +79,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.
 
Profile Information
Profile TitleCIS Red Hat Enterprise Linux 7 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis
CPE Platforms
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::workstation
  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
Revision History
Current version: 0.1.68
  • draft
-                    (as of 2023-06-18)
+                    (as of 2039-07-21)
                 
Table of Contents
  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Print Support
    14. Proxy Server
    15. Samba(SMB) Microsoft Windows File Sharing Server
    16. SNMP Server
    17. SSH Server
    18. X Window System
Checklist
Group  
                 Guide to the Secure Configuration of Red Hat Enterprise Linux 7
                           Group contains 110 groups and 329 rules
Group  
@@ -123,7 +123,19 @@
                                   [ref]
The aide package can be installed with the following command:
 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:enable

+package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
     state: present
@@ -140,20 +152,6 @@
   - medium_severity
   - no_reboot_needed
   - package_aide_installed
-


-[[packages]]
-name = "aide"
-version = "*"
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 

Complexity:low
Disruption:low
Strategy:enable
include install_aide
 
 class install_aide {
@@ -161,8 +159,10 @@
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-package --add=aide
+


+[[packages]]
+name = "aide"
+version = "*"
 
Rule  
                                 Build and Test AIDE Database
                                   [ref]
Run the following command to generate a new database:
@@ -184,7 +184,20 @@
 
$ sudo /usr/sbin/aide --check

 If this check produces any unexpected output, investigate.
Rationale:
For AIDE to be effective, an initial database of "known-good" information about files
 must be captured and it should be able to be verified against the installed files.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_build_database
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r880854_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+
+/usr/sbin/aide --init
+/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name: '{{ item }}'
     state: present
@@ -260,19 +273,6 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-
-/usr/sbin/aide --init
-/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi
 
Rule  
                                 Configure Periodic Execution of AIDE
                                   [ref]
At a minimum, AIDE should be configured to run a weekly scan.
@@ -295,7 +295,27 @@
 system. The operating system's Information Management Officer (IMO)/Information System
 Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
 monitoring system trap when there is an unauthorized modification of a configuration item.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
Identifiers and References
References: 
-            BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, 11.5.2, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, 1.3.2, SV-204445r880848_rule


# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+if ! rpm -q --quiet "aide" ; then
+    yum install -y "aide"
+fi
+if ! rpm -q --quiet "crontabs" ; then
+    yum install -y "crontabs"
+fi
+
+if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
+    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
+else
+    sed -i '\!^.* --check.*$!d' /etc/crontab
+    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
+fi
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
+fi
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Ensure AIDE is installed
   package:
     name:
     - aide
@@ -402,33 +422,26 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
-

# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-
-if ! rpm -q --quiet "aide" ; then
-    yum install -y "aide"
-fi
-if ! rpm -q --quiet "crontabs" ; then
-    yum install -y "crontabs"
-fi
-
-if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
-    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
-else
-    sed -i '\!^.* --check.*$!d' /etc/crontab
-    echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
-fi
-
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
-fi