The prior wording of the C2S profile contained a statement that the C2S profile,
as it is derived from CIS' publicly available RHEL6 Benchmark [1],
could measure a system against the CIS RHEL6 baseline.
We have been informed that per CIS' terms and conditions, specifically under
RESTRICTIONS, item #8, one may not "represent or claim a particular level of
compliance or consistency with any SB product."
To remain in compliance with CIS' request, this patch updates the C2S profile
description to indicate that while the C2S profile may be sourced from the public,
freely available CIS benchmark, no representation or claim to a particular
level of compliance or consistency is being made.
CIS is eager to collaborate more closely with the community (and Red Hat) on
guidance development, in particular through the SCAP Security Guide. They have
expressed that having automated security guidance and workflows ship with the Operating
System is definitely a positive step, and one they encourage. Unfortunately, we were
unable to reconcile the CIS Terms and Conditions to provide a freely available SCAP
profile against the CIS baseline. When faced with the choice of paying
~$20,000 license fees [2], or rewording references to CIS compliance, the later was
chosen.
[1]
https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Lin...
mark_v1.2.0.pdf
[2]
http://benchmarks.cisecurity.org/membership/certified/overview/
Signed-off-by: Shawn Wells <shawn(a)redhat.com>
---
RHEL/6/input/profiles/C2S.xml | 504 ++++++++++++++++++++---------------------
1 files changed, 250 insertions(+), 254 deletions(-)
diff --git a/RHEL/6/input/profiles/C2S.xml b/RHEL/6/input/profiles/C2S.xml
index 282da6a..ef97fc2 100644
--- a/RHEL/6/input/profiles/C2S.xml
+++ b/RHEL/6/input/profiles/C2S.xml
@@ -1,19 +1,15 @@
<Profile id="C2S">
<title>C2S for Red Hat Enterprise Linux 6</title>
<description>This profile demonstrates compliance against the
-U.S. Government C2S baseline.
-
-This baseline is tied to the Center for Internet Security's
-Red Hat Enterprise Linux 6 Benchmark, v1.2.0 - 06-25-2013,
-and uses the same refine values. One could use C2S interchangably
-with CIS v1.2.0. For a copy of the CIS RHEL6 benchmark, refer
-to:
-https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.2.0.pdf
-
-This profile is not production ready and should be considered
-development preview. As of 13-APR-2014, Out of the 233
-policy-mandated checks, only 169 currently have associated OVAL.
-Patches would be most welcome!
+U.S. Government Commercial Cloud Services (C2S) baseline.
+
+This baseline was inspired by the Center for Internet Security
+(CIS) Red Hat Enterprise Linux 6 Benchmark, v1.2.0 - 06-25-2013.
+For the SCAP Security Guide project to remain in compliance with
+CIS' terms and conditions, specifically Restrictions(8), note
+there is no representation or claim that the C2S profile will
+ensure a system is in compliance or consistency with the CIS
+baseline.
</description>
<!-- BEGIN REFINE VALUES -->
@@ -26,698 +22,698 @@ Patches would be most welcome!
<!-- No edits past this point should be needed -->
-<!--
+<!-- CIS
1 Install Updates, Patches and Additional Security Software
1.1 Filesystem Configuration -->
-<!-- 1.1.1 Create Separate Partition for /tmp (Scored) -->
+<!-- CIS 1.1.1 Create Separate Partition for /tmp (Scored) -->
<select idref="partition_for_tmp" selected="true"/>
-<!-- 1.1.2 Set nodev option for /tmp Partition (Scored) -->
+<!-- CIS 1.1.2 Set nodev option for /tmp Partition (Scored) -->
<select idref="mount_option_tmp_nodev" selected="true" />
-<!-- 1.1.3 Set nosuid option for /tmp Partition (Scored) -->
+<!-- CIS 1.1.3 Set nosuid option for /tmp Partition (Scored) -->
<select idref="mount_option_tmp_nosuid" selected="true" />
-<!-- 1.1.4 Set noexec option for /tmp Partition (Scored) -->
+<!-- CIS 1.1.4 Set noexec option for /tmp Partition (Scored) -->
<select idref="mount_option_tmp_noexec" selected="true" />
-<!-- 1.1.5 Create Separate Partition for /var (Scored) -->
+<!-- CIS 1.1.5 Create Separate Partition for /var (Scored) -->
<select idref="partition_for_var" selected="true"/>
-<!-- 1.1.6 Bind Mount the /var/tmp directory to /tmp (Scored) -->
+<!-- CIS 1.1.6 Bind Mount the /var/tmp directory to /tmp (Scored) -->
<select idref="mount_option_var_tmp_bind_var" selected="true"
/>
-<!-- 1.1.7 Create Separate Partition for /var/log -->
+<!-- CIS 1.1.7 Create Separate Partition for /var/log -->
<select idref="partition_for_var_log" selected="true"/>
-<!-- 1.1.8 Create Separate Partition for /var/log/audit (Scored) -->
+<!-- CIS 1.1.8 Create Separate Partition for /var/log/audit (Scored) -->
<select idref="partition_for_var_log_audit" selected="true"/>
-<!-- 1.1.9 Create Separate Partition for /home (Scored) -->
+<!-- CIS 1.1.9 Create Separate Partition for /home (Scored) -->
<select idref="partition_for_home" selected="true"/>
-<!-- 1.1.10 Add nodev Option to /home (Scored) -->
+<!-- CIS 1.1.10 Add nodev Option to /home (Scored) -->
<select idref="mountopt_nodev_on_nonroot_partitions"
selected="true" />
-<!-- 1.1.11 Add nodev Option to Removable Media Partitions (Not Scored) -->
+<!-- CIS 1.1.11 Add nodev Option to Removable Media Partitions (Not Scored) -->
<select idref="mountopt_nodev_on_removable_partitions"
selected="true" />
-<!-- 1.1.12 Add noexec Option to Removable Media Partitions (Not Scored) -->
+<!-- CIS 1.1.12 Add noexec Option to Removable Media Partitions (Not Scored) -->
<select idref="mount_option_noexec_removable_partitions"
selected="true" />
-<!-- 1.1.13 Add nosuid Option to Removable Media Partitions (Not Scored) -->
+<!-- CIS 1.1.13 Add nosuid Option to Removable Media Partitions (Not Scored) -->
<select idref="mountopt_nosuid_on_removable_partitions"
selected="true" />
-<!-- 1.1.14 Add nodev Option to /dev/shm Partition (Scored) -->
+<!-- CIS 1.1.14 Add nodev Option to /dev/shm Partition (Scored) -->
<select idref="mount_option_dev_shm_nodev" selected="true" />
-<!-- 1.1.15 Add nosuid Option to /dev/shm Partition (Scored) -->
+<!-- CIS 1.1.15 Add nosuid Option to /dev/shm Partition (Scored) -->
<select idref="mount_option_dev_shm_nosuid" selected="true" />
-<!-- 1.1.16 Add noexec Option to /dev/shm Partition (Scored) -->
+<!-- CIS 1.1.16 Add noexec Option to /dev/shm Partition (Scored) -->
<select idref="mount_option_dev_shm_noexec" selected="true" />
-<!-- 1.1.17 Set Sticky Bit on All World-Writable Directories (Scored) -->
+<!-- CIS 1.1.17 Set Sticky Bit on All World-Writable Directories (Scored) -->
<select idref="sticky_world_writable_dirs" selected="true" />
-<!-- 1.1.18 Disable Mounting of cramfs Filesystems (Not Scored) -->
+<!-- CIS 1.1.18 Disable Mounting of cramfs Filesystems (Not Scored) -->
<select idref="kernel_module_cramfs_disabled" selected="true"
/>
-<!-- 1.1.19 Disable Mounting of freevxfs Filesystems (Not Scored) -->
+<!-- CIS 1.1.19 Disable Mounting of freevxfs Filesystems (Not Scored) -->
<select idref="kernel_module_freevxfs_disabled" selected="true"
/>
-<!-- 1.1.20 Disable Mounting of jffs2 Filesystems (Not Scored) -->
+<!-- CIS 1.1.20 Disable Mounting of jffs2 Filesystems (Not Scored) -->
<select idref="kernel_module_jffs2_disabled" selected="true"
/>
-<!-- 1.1.21 Disable Mounting of hfs Filesystems (Not Scored) -->
+<!-- CIS 1.1.21 Disable Mounting of hfs Filesystems (Not Scored) -->
<select idref="kernel_module_hfs_disabled" selected="true" />
-<!-- 1.1.22 Disable Mounting of hfsplus Filesystems (Not Scored) -->
+<!-- CIS 1.1.22 Disable Mounting of hfsplus Filesystems (Not Scored) -->
<select idref="kernel_module_hfsplus_disabled" selected="true"
/>
-<!-- 1.1.23 Disable Mounting of squashfs Filesystems (Not Scored) -->
+<!-- CIS 1.1.23 Disable Mounting of squashfs Filesystems (Not Scored) -->
<select idref="kernel_module_squashfs_disabled" selected="true"
/>
-<!-- 1.1.24 Disable Mounting of udf Filesystems (Not Scored) -->
+<!-- CIS 1.1.24 Disable Mounting of udf Filesystems (Not Scored) -->
<select idref="kernel_module_udf_disabled" selected="true" />
-<!-- 1.2 Configure Software Updates -->
-<!-- 1.2.1 Configure Connection to the RHN RPM Repositories (Not Scored) -->
+<!-- CIS 1.2 Configure Software Updates -->
+<!-- CIS 1.2.1 Configure Connection to the RHN RPM Repositories (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->
-<!-- 1.2.2 Verify Red Hat GPG Key is Installed (Scored) -->
+<!-- CIS 1.2.2 Verify Red Hat GPG Key is Installed (Scored) -->
<select idref="ensure_redhat_gpgkey_installed"
selected="true"/>
-<!-- 1.2.3 Verify that gpgcheck is Globally Activated (Scored) -->
+<!-- CIS 1.2.3 Verify that gpgcheck is Globally Activated (Scored) -->
<select idref="ensure_gpgcheck_globally_activated"
selected="true"/>
<select idref="ensure_gpgcheck_never_disabled"
selected="true"/>
-<!-- 1.2.4 Disable the rhnsd Daemon (Not Scored) -->
+<!-- CIS 1.2.4 Disable the rhnsd Daemon (Not Scored) -->
<select idref="service_rhnsd_disabled" selected="true"/>
-<!-- 1.2.5 Obtain Software Package Updates with yum (Not Scored) -->
+<!-- CIS 1.2.5 Obtain Software Package Updates with yum (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->
-<!-- 1.2.6 Verify Package Integrity Using RPM (Not Scored) -->
+<!-- CIS 1.2.6 Verify Package Integrity Using RPM (Not Scored) -->
<select idref="rpm_verify_permissions" selected="true" />
<select idref="rpm_verify_hashes" selected="true" />
-<!-- 1.3 Advanced Intrusion Detection Environment (AIDE) -->
-<!-- 1.3.1 Install AIDE (Scored) -->
+<!-- CIS 1.3 Advanced Intrusion Detection Environment (AIDE) -->
+<!-- CIS 1.3.1 Install AIDE (Scored) -->
<select idref="package_aide_installed" selected="true" />
-<!-- 1.3.2 Implement Periodic Execution of File Integrity (Scored) -->
+<!-- CIS 1.3.2 Implement Periodic Execution of File Integrity (Scored) -->
<select idref="disable_prelink" selected="true" />
<select idref="aide_build_database" selected="true" />
<select idref="aide_periodic_cron_checking" selected="true" />
-<!-- 1.4 Configure SELinux -->
-<!-- 1.4.1 Enable SELinux in /etc/grub.conf (Scored) -->
+<!-- CIS 1.4 Configure SELinux -->
+<!-- CIS 1.4.1 Enable SELinux in /etc/grub.conf (Scored) -->
<select idref="enable_selinux_bootloader" selected="true" />
-<!-- 1.4.2 Set the SELinux State (Scored) -->
+<!-- CIS 1.4.2 Set the SELinux State (Scored) -->
<select idref="selinux_state" selected="true" />
-<!-- 1.4.3 Set the SELinux Policy (Scored) -->
+<!-- CIS 1.4.3 Set the SELinux Policy (Scored) -->
<select idref="selinux_policytype" selected="true" />
-<!-- 1.4.4 Remove SETroubleshoot (Scored) -->
+<!-- CIS 1.4.4 Remove SETroubleshoot (Scored) -->
<select idref="package_setroubleshoot_removed" selected="true"
/>
-<!-- 1.4.5 Remove MCS Translation Service (mcstrans) (Scored) -->
+<!-- CIS 1.4.5 Remove MCS Translation Service (mcstrans) (Scored) -->
<select idref="package_mcstrans_removed" selected="true" />
-<!-- 1.4.6 Check for Unconfined Daemons (Scored) -->
+<!-- CIS 1.4.6 Check for Unconfined Daemons (Scored) -->
<select idref="selinux_confinement_of_daemons" selected="true"
/>
-<!-- 1.5 Secure Boot Settings -->
-<!-- 1.5.1 Set User/Group Owner on /etc/grub.conf (Scored) -->
+<!-- CIS 1.5 Secure Boot Settings -->
+<!-- CIS 1.5.1 Set User/Group Owner on /etc/grub.conf (Scored) -->
<select idref="user_owner_grub_conf" selected="true"/>
<select idref="group_owner_grub_conf" selected="true"/>
-<!-- 1.5.2 Set Permissions on /etc/grub.conf (Scored) -->
+<!-- CIS 1.5.2 Set Permissions on /etc/grub.conf (Scored) -->
<select idref="permissions_grub_conf" selected="true"/>
-<!-- 1.5.3 Set Boot Loader Password (Scored) -->
+<!-- CIS 1.5.3 Set Boot Loader Password (Scored) -->
<select idref="bootloader_password" selected="true"/>
-<!-- 1.5.4 Require Authentication for Single-User Mode (Scored) -->
+<!-- CIS 1.5.4 Require Authentication for Single-User Mode (Scored) -->
<select idref="require_singleuser_auth" selected="true"/>
-<!-- 1.5.5 Disable Interactive Boot (Scored) -->
+<!-- CIS 1.5.5 Disable Interactive Boot (Scored) -->
<select idref="disable_interactive_boot" selected="true"/>
-<!-- 1.6 Additional Process Hardening -->
-<!-- 1.6.1 Restrict Core Dumps (Scored) -->
+<!-- CIS 1.6 Additional Process Hardening -->
+<!-- CIS 1.6.1 Restrict Core Dumps (Scored) -->
<select idref="disable_users_coredumps" selected="true" />
<select idref="sysctl_fs_suid_dumpable" selected="true" />
-<!-- 1.6.2 Configure ExecShield (Scored) -->
+<!-- CIS 1.6.2 Configure ExecShield (Scored) -->
<select idref="sysctl_kernel_exec_shield" selected="true"/>
-<!-- 1.6.3 Enable Randomized Virtual Memory Region Placement (Scored) -->
+<!-- CIS 1.6.3 Enable Randomized Virtual Memory Region Placement (Scored) -->
<select idref="sysctl_kernel_randomize_va_space"
selected="true"/>
-<!-- 1.7 Use the Latest OS Release (Not Scored) -->
-<!-- 2 OS Services -->
-<!-- 2.1 Remove Legacy Services -->
-<!-- 2.1.1 Remove telnet-server (Scored) -->
+<!-- CIS 1.7 Use the Latest OS Release (Not Scored) -->
+<!-- CIS 2 OS Services -->
+<!-- CIS 2.1 Remove Legacy Services -->
+<!-- CIS 2.1.1 Remove telnet-server (Scored) -->
<select idref="uninstall_telnet_server" selected="true"/>
-<!-- 2.1.2 Remove telnet Clients (Scored) -->
+<!-- CIS 2.1.2 Remove telnet Clients (Scored) -->
<select idref="package_telnet_removed" selected="true" />
-<!-- 2.1.3 Remove rsh-server (Scored) -->
+<!-- CIS 2.1.3 Remove rsh-server (Scored) -->
<select idref="uninstall_rsh-server" selected="true"/>
-<!-- 2.1.4 Remove rsh (Scored) -->
+<!-- CIS 2.1.4 Remove rsh (Scored) -->
<select idref="package_rsh_removed" selected="true" />
-<!-- 2.1.5 Remove NIS Client (Scored) -->
+<!-- CIS 2.1.5 Remove NIS Client (Scored) -->
<select idref="package_ypbind_removed" selected="true" />
-<!-- 2.1.6 Remove NIS Server (Scored) -->
+<!-- CIS 2.1.6 Remove NIS Server (Scored) -->
<select idref="uninstall_ypserv" selected="true" />
-<!-- 2.1.7 Remove tftp (Scored) -->
+<!-- CIS 2.1.7 Remove tftp (Scored) -->
<select idref="package_tftp_removed" selected="true" />
-<!-- 2.1.8 Remove tftp-server (Scored) -->
+<!-- CIS 2.1.8 Remove tftp-server (Scored) -->
<select idref="uninstall_tftp-server" selected="true"/>
-<!-- 2.1.9 Remove talk (Scored) -->
+<!-- CIS 2.1.9 Remove talk (Scored) -->
<!-- NEEDS RULE -->
-<!-- 2.1.10 Remove talk-server (Scored) -->
+<!-- CIS 2.1.10 Remove talk-server (Scored) -->
<!-- NEEDS RULE -->
-<!-- 2.1.11 Remove xinetd (Scored) -->
+<!-- CIS 2.1.11 Remove xinetd (Scored) -->
<select idref="uninstall_xinetd" selected="true"/>
-<!-- 2.1.12 Disable chargen-dgram (Scored) -->
+<!-- CIS 2.1.12 Disable chargen-dgram (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->
-<!-- 2.1.13 Disable chargen-stream (Scored) -->
+<!-- CIS 2.1.13 Disable chargen-stream (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->
-<!-- 2.1.14 Disable daytime-dgram (Scored) -->
+<!-- CIS 2.1.14 Disable daytime-dgram (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->
-<!-- 2.1.15 Disable daytime-stream (Scored) -->
+<!-- CIS 2.1.15 Disable daytime-stream (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->
-<!-- 2.1.16 Disable echo-dgram (Scored) -->
+<!-- CIS 2.1.16 Disable echo-dgram (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->
-<!-- 2.1.17 Disable echo-stream (Scored) -->
+<!-- CIS 2.1.17 Disable echo-stream (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->
-<!-- 2.1.18 Disable tcpmux-server (Scored) -->
+<!-- CIS 2.1.18 Disable tcpmux-server (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->
-<!-- 3 Special Purpose Services -->
-<!-- 3.1 Set Daemon umask (Scored) -->
+<!-- CIS 3 Special Purpose Services -->
+<!-- CIS 3.1 Set Daemon umask (Scored) -->
<select idref="umask_for_daemons" selected="true" />
-<!-- 3.2 Remove X Windows (Scored) -->
+<!-- CIS 3.2 Remove X Windows (Scored) -->
<select idref="packagegroup_xwindows_remove" selected="true"
/>
-<!-- 3.3 Disable Avahi Server (Scored) -->
+<!-- CIS 3.3 Disable Avahi Server (Scored) -->
<select idref="disable_avahi" selected="true" />
-<!-- 3.4 Disable Print Server - CUPS (Not Scored) -->
+<!-- CIS 3.4 Disable Print Server - CUPS (Not Scored) -->
<select idref="service_cups_disabled" selected="true" />
-<!-- 3.5 Remove DHCP Server (Scored) -->
+<!-- CIS 3.5 Remove DHCP Server (Scored) -->
<select idref="uninstall_dhcp_server" selected="true" />
-<!-- 3.6 Configure Network Time Protocol (NTP) (Scored) -->
+<!-- CIS 3.6 Configure Network Time Protocol (NTP) (Scored) -->
<select idref="service_ntpd_enabled" selected="true" />
<select idref="ntpd_specify_remote_server" selected="true" />
<select idref="ntpd_specify_multiple_servers" selected="true"
/>
-<!-- 3.7 Remove LDAP (Not Scored) -->
+<!-- CIS 3.7 Remove LDAP (Not Scored) -->
<select idref="package_openldap-servers_removed" selected="true"
/>
-<!-- 3.8 Disable NFS and RPC (Not Scored) -->
+<!-- CIS 3.8 Disable NFS and RPC (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->
-<!-- 3.9 Remove DNS Server (Not Scored) -->
+<!-- CIS 3.9 Remove DNS Server (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->
-<!-- 3.10 Remove FTP Server (Not Scored) -->
+<!-- CIS 3.10 Remove FTP Server (Not Scored) -->
<select idref="uninstall_vsftpd" selected="true" />
-<!-- 3.11 Remove HTTP Server (Not Scored) -->
+<!-- CIS 3.11 Remove HTTP Server (Not Scored) -->
<select idref="uninstall_httpd" selected="true" />
-<!-- 3.12 Remove Dovecot (IMAP and POP3 services) (Not Scored) -->
+<!-- CIS 3.12 Remove Dovecot (IMAP and POP3 services) (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->
-<!-- 3.13 Remove Samba (Not Scored) -->
+<!-- CIS 3.13 Remove Samba (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->
-<!-- 3.14 Remove HTTP Proxy Server (Not Scored) -->
+<!-- CIS 3.14 Remove HTTP Proxy Server (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->
-<!-- 3.15 Remove SNMP Server (Not Scored) -->
+<!-- CIS 3.15 Remove SNMP Server (Not Scored) -->
<select idref="uninstall_net-snmp" selected="true"/>
-<!-- 3.16 Configure Mail Transfer Agent for Local-Only Mode (Scored) -->
+<!-- CIS 3.16 Configure Mail Transfer Agent for Local-Only Mode (Scored) -->
<select idref="postfix_network_listening" selected="true" />
-<!-- 4 Network Configuration and Firewalls -->
-<!-- 4.1 Modify Network Parameters (Host Only) -->
-<!--4.1.1 Disable IP Forwarding (Scored) -->
+<!-- CIS 4 Network Configuration and Firewalls -->
+<!-- CIS 4.1 Modify Network Parameters (Host Only) -->
+<!-- CIS4.1.1 Disable IP Forwarding (Scored) -->
<select idref="sysctl_ipv4_ip_forward" selected="true"/>
-<!--4.1.2 Disable Send Packet Redirects (Scored) -->
+<!-- CIS4.1.2 Disable Send Packet Redirects (Scored) -->
<select idref="sysctl_net_ipv4_conf_default_send_redirects"
selected="true"/>
<select idref="sysctl_ipv4_all_send_redirects"
selected="true"/>
-<!-- 4.2 Modify Network Parameters (Host and Router) -->
-<!-- 4.2.1 Disable Source Routed Packet Acceptance (Scored) -->
+<!-- CIS 4.2 Modify Network Parameters (Host and Router) -->
+<!-- CIS 4.2.1 Disable Source Routed Packet Acceptance (Scored) -->
<select idref="sysctl_net_ipv4_conf_all_accept_source_route"
selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_accept_source_route"
selected="true"/>
-<!-- 4.2.2 Disable ICMP Redirect Acceptance (Scored) -->
+<!-- CIS 4.2.2 Disable ICMP Redirect Acceptance (Scored) -->
<select idref="sysctl_net_ipv4_conf_all_accept_redirects"
selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_accept_redirects"
selected="true"/>
-<!-- 4.2.3 Disable Secure ICMP Redirect Acceptance (Scored)-->
+<!-- CIS 4.2.3 Disable Secure ICMP Redirect Acceptance (Scored)-->
<select idref="sysctl_net_ipv4_conf_all_secure_redirects"
selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_secure_redirects"
selected="true"/>
-<!-- 4.2.4 Log Suspicious Packets (Scored) -->
+<!-- CIS 4.2.4 Log Suspicious Packets (Scored) -->
<select idref="sysctl_net_ipv4_conf_all_log_martians"
selected="true"/>
-<!-- 4.2.5 Enable Ignore Broadcast Requests (Scored) -->
+<!-- CIS 4.2.5 Enable Ignore Broadcast Requests (Scored) -->
<select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts"
selected="true"/>
-<!-- 4.2.6 Enable Bad Error Message Protection (Scored) -->
+<!-- CIS 4.2.6 Enable Bad Error Message Protection (Scored) -->
<select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"
selected="true"/>
-<!-- 4.2.7 Enable RFC-recommended Source Route Validation (Scored)-->
+<!-- CIS 4.2.7 Enable RFC-recommended Source Route Validation (Scored)-->
<select idref="sysctl_net_ipv4_conf_all_rp_filter"
selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_rp_filter"
selected="true"/>
-<!-- 4.2.8 Enable TCP SYN Cookies (Scored) -->
+<!-- CIS 4.2.8 Enable TCP SYN Cookies (Scored) -->
<select idref="sysctl_net_ipv4_tcp_syncookies"
selected="true"/>
-<!-- 4.3 Wireless Networking -->
-<!-- 4.3.1 Deactivate Wireless Interfaces (Not Scored) -->
+<!-- CIS 4.3 Wireless Networking -->
+<!-- CIS 4.3.1 Deactivate Wireless Interfaces (Not Scored) -->
<select idref="wireless_disable_in_bios" selected="true" />
<select idref="deactivate_wireless_interfaces" selected="true"
/>
-<!-- 4.4 Disable IPv6 -->
-<!-- 4.4.1 Configure IPv6 -->
-<!-- 4.4.1.1 Disable IPv6 Router Advertisements (Not Scored) -->
+<!-- CIS 4.4 Disable IPv6 -->
+<!-- CIS 4.4.1 Configure IPv6 -->
+<!-- CIS 4.4.1.1 Disable IPv6 Router Advertisements (Not Scored) -->
<select idref="sysctl_net_ipv6_conf_default_accept_ra"
selected="true" />
<!-- NEEDS: net.ipv6.conf.all.accept_ra -->
-<!-- 4.4.1.2 Disable IPv6 Redirect Acceptance (Not Scored) -->
+<!-- CIS 4.4.1.2 Disable IPv6 Redirect Acceptance (Not Scored) -->
<select idref="sysctl_ipv6_default_accept_redirects"
selected="true" />
<!-- NEEDS: net.ipv6.conf.default.accept_redirects -->
-<!-- 4.4.2 Disable IPv6 (Not Scored) -->
+<!-- CIS 4.4.2 Disable IPv6 (Not Scored) -->
<select idref="network_ipv6_disable_interfaces" selected="true"
/>
-<!-- 4.5 Install TCP Wrappers -->
-<!-- 4.5.1 Install TCP Wrappers (Not Scored) -->
+<!-- CIS 4.5 Install TCP Wrappers -->
+<!-- CIS 4.5.1 Install TCP Wrappers (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->
-<!-- 4.5.2 Create /etc/hosts.allow (Not Scored) -->
+<!-- CIS 4.5.2 Create /etc/hosts.allow (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->
-<!-- 4.5.3 Verify Permissions on /etc/hosts.allow (Scored) -->
+<!-- CIS 4.5.3 Verify Permissions on /etc/hosts.allow (Scored) -->
<!-- This rule is met through RPM Verify, will add mappings later -->
-<!-- 4.5.4 Create /etc/hosts.deny (Not Scored) -->
+<!-- CIS 4.5.4 Create /etc/hosts.deny (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->
-<!-- 4.5.5 Verify Permissions on /etc/hosts.deny (Scored)-->
+<!-- CIS 4.5.5 Verify Permissions on /etc/hosts.deny (Scored)-->
<!-- This rule is met through RPM Verify, will add mappings later -->
-
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->
-<!-- 4.6 Uncommon Network Protocols-->
-<!-- 4.6.1 Disable DCCP (Not Scored) -->
+
+<!-- CIS 4.6 Uncommon Network Protocols-->
+<!-- CIS 4.6.1 Disable DCCP (Not Scored) -->
<select idref="kernel_module_dccp_disabled" selected="true"/>
-<!-- 4.6.2 Disable SCTP (Not Scored) -->
+<!-- CIS 4.6.2 Disable SCTP (Not Scored) -->
<select idref="kernel_module_sctp_disabled" selected="true"/>
-<!-- 4.6.3 Disable RDS (Not Scored) -->
+<!-- CIS 4.6.3 Disable RDS (Not Scored) -->
<select idref="kernel_module_rds_disabled" selected="true"/>
-<!-- 4.6.4 Disable TIPC (Not Scored) -->
+<!-- CIS 4.6.4 Disable TIPC (Not Scored) -->
<select idref="kernel_module_tipc_disabled" selected="true"/>
-<!-- 4.7 Enable IPtables (Scored) -->
+<!-- CIS 4.7 Enable IPtables (Scored) -->
<select idref="service_iptables_enabled" selected="true"/>
-<!-- 4.8 Enable IP6tables (Not Scored) -->
+<!-- CIS 4.8 Enable IP6tables (Not Scored) -->
<select idref="service_ip6tables_enabled" selected="true"/>
-<!-- 5 Logging and Auditing-->
-<!-- 5.1 Configure rsyslog -->
-<!-- 5.1.1 Install the rsyslog package (Scored) -->
+<!-- CIS 5 Logging and Auditing-->
+<!-- CIS 5.1 Configure rsyslog -->
+<!-- CIS 5.1.1 Install the rsyslog package (Scored) -->
<select idref="package_rsyslog_installed" selected="true"/>
-<!-- 5.1.2 Activate the rsyslog Service (Scored) -->
+<!-- CIS 5.1.2 Activate the rsyslog Service (Scored) -->
<select idref="service_rsyslog_enabled" selected="true"/>
-<!-- 5.1.3 Configure /etc/rsyslog.conf (Not Scored) -->
+<!-- CIS 5.1.3 Configure /etc/rsyslog.conf (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->
-<!-- 5.1.4 Create and Set Permissions on rsyslog Log Files (Scored)-->
+<!-- CIS 5.1.4 Create and Set Permissions on rsyslog Log Files (Scored)-->
<select idref="rsyslog_file_permissions" selected="true"/>
-<!-- 5.1.5 Configure rsyslog to Send Logs to a Remote Log Host (Scored) -->
+<!-- CIS 5.1.5 Configure rsyslog to Send Logs to a Remote Log Host (Scored) -->
<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
-<!-- 5.1.6 Accept Remote rsyslog Messages Only on Designated Log Hosts (Not Scored)
-->
+<!-- CIS 5.1.6 Accept Remote rsyslog Messages Only on Designated Log Hosts (Not
Scored) -->
<select idref="rsyslog_accept_remote_messages_none"
selected="true" />
-<!-- 5.2 Configure System Accounting (auditd) -->
-<!-- 5.2.1 Configure Data Retention -->
-<!-- 5.2.1.1 Configure Audit Log Storage Size (Not Scored) -->
+<!-- CIS 5.2 Configure System Accounting (auditd) -->
+<!-- CIS 5.2.1 Configure Data Retention -->
+<!-- CIS 5.2.1.1 Configure Audit Log Storage Size (Not Scored) -->
<select idref="configure_auditd_max_log_file"
selected="true"/>
-<!-- 5.2.1.2 Disable System on Audit Log Full (Not Scored) -->
+<!-- CIS 5.2.1.2 Disable System on Audit Log Full (Not Scored) -->
<select idref="auditd_data_retention_space_left_action"
selected="true" />
<select idref="auditd_data_retention_action_mail_acct"
selected="true" />
<select idref="auditd_data_retention_admin_space_left_action"
selected="true" />
-<!-- 5.2.1.3 Keep All Auditing Information (Scored) -->
+<!-- CIS 5.2.1.3 Keep All Auditing Information (Scored) -->
<select idref="configure_auditd_max_log_file_action"
selected="true" />
-<!-- 5.2.2 Enable auditd Service (Scored) -->
+<!-- CIS 5.2.2 Enable auditd Service (Scored) -->
<select idref="service_auditd_enabled" selected="true"/>
-<!-- 5.2.3 Enable Auditing for Processes That Start Prior to auditd (Scored) -->
+<!-- CIS 5.2.3 Enable Auditing for Processes That Start Prior to auditd (Scored)
-->
<select idref="enable_auditd_bootloader" selected="true"/>
-<!-- 5.2.4 Record Events That Modify Date and Time Information (Scored) -->
+<!-- CIS 5.2.4 Record Events That Modify Date and Time Information (Scored) -->
<select idref="audit_rules_time_adjtimex" selected="true" />
<select idref="audit_rules_time_settimeofday" selected="true"
/>
<select idref="audit_rules_time_stime" selected="true" />
<select idref="audit_rules_time_watch_localtime" selected="true"
/>
-<!-- 5.2.5 Record Events That Modify User/Group Information (Scored) -->
+<!-- CIS 5.2.5 Record Events That Modify User/Group Information (Scored) -->
<select idref="audit_account_changes" selected="true" />
-<!-- 5.2.6 Record Events That Modify the System's Network Environment (Scored)
-->
+<!-- CIS 5.2.6 Record Events That Modify the System's Network Environment (Scored)
-->
<select idref="audit_network_modifications" selected="true" />
-<!-- 5.2.7 Record Events That Modify the System's Mandatory Access Controls
(Scored) -->
+<!-- CIS 5.2.7 Record Events That Modify the System's Mandatory Access Controls
(Scored) -->
<select idref="audit_mac_changes" selected="true" />
-<!-- 5.2.8 Collect Login and Logout Events (Scored) -->
+<!-- CIS 5.2.8 Collect Login and Logout Events (Scored) -->
<select idref="audit_manual_logon_edits" selected="true" />
-<!-- 5.2.9 Collect Session Initiation Information (Scored) -->
+<!-- CIS 5.2.9 Collect Session Initiation Information (Scored) -->
<select idref="audit_manual_session_edits" selected="true" />
-<!-- 5.2.10 Collect Discretionary Access Control Permission Modification Events
(Scored)-->
+<!-- CIS 5.2.10 Collect Discretionary Access Control Permission Modification Events
(Scored)-->
<select idref="audit_dac_actions" selected="true" />
-<!-- 5.2.11 Collect Unsuccessful Unauthorized Access Attempts to Files (Scored)
-->
+<!-- CIS 5.2.11 Collect Unsuccessful Unauthorized Access Attempts to Files (Scored)
-->
<select idref="audit_rules_unsuccessful_file_modification"
selected="true" />
-<!-- 5.2.12 Collect Use of Privileged Commands (Scored) -->
+<!-- CIS 5.2.12 Collect Use of Privileged Commands (Scored) -->
<select idref="audit_privileged_commands" selected="true" />
-<!-- 5.2.13 Collect Successful File System Mounts (Scored)-->
+<!-- CIS 5.2.13 Collect Successful File System Mounts (Scored)-->
<select idref="audit_media_exports" selected="true" />
-<!-- 5.2.14 Collect File Deletion Events by User (Scored) -->
+<!-- CIS 5.2.14 Collect File Deletion Events by User (Scored) -->
<select idref="audit_rules_file_deletion_events" selected="true"
/>
-<!-- 5.2.15 Collect Changes to System Administration Scope (sudoers) (Scored) -->
+<!-- CIS 5.2.15 Collect Changes to System Administration Scope (sudoers) (Scored)
-->
<select idref="audit_sysadmin_actions" selected="true" />
-<!-- 5.2.16 Collect System Administrator Actions (sudolog) (Scored) -->
+<!-- CIS 5.2.16 Collect System Administrator Actions (sudolog) (Scored) -->
<!-- NEEDS RULE -->
<!-- sdw/jb: this rule is wrong. will work with CIS to correct in future editions
-->
-<!-- 5.2.17 Collect Kernel Module Loading and Unloading (Scored) -->
+<!-- CIS 5.2.17 Collect Kernel Module Loading and Unloading (Scored) -->
<select idref="audit_kernel_module_loading" selected="true" />
-<!-- 5.2.18 Make the Audit Configuration Immutable (Scored) -->
+<!-- CIS 5.2.18 Make the Audit Configuration Immutable (Scored) -->
<select idref="audit_config_immutable" selected="true" />
-<!-- 5.3 Configure logrotate (Not Scored) -->
+<!-- CIS 5.3 Configure logrotate (Not Scored) -->
<select idref="ensure_logrotate_activated" selected="true" />
-<!-- 6 System Access, Authentication and Authorization -->
-<!-- 6.1 Configure cron and anacron -->
-<!-- 6.1.1 Enable anacron Daemon (Scored) -->
+<!-- CIS 6 System Access, Authentication and Authorization -->
+<!-- CIS 6.1 Configure cron and anacron -->
+<!-- CIS 6.1.1 Enable anacron Daemon (Scored) -->
<!-- NEEDS RULE -->
<!-- Low priority, given anacron is enabled by default -->
<!-- ... and the security relevance is not clear ... -->
-<!-- 6.1.2 Enable crond Daemon (Scored) -->
+<!-- CIS 6.1.2 Enable crond Daemon (Scored) -->
<select idref="service_crond_enabled" selected="true" />
-<!-- 6.1.3 Set User/Group Owner and Permission on /etc/anacrontab (Scored) -->
+<!-- CIS 6.1.3 Set User/Group Owner and Permission on /etc/anacrontab (Scored) -->
<!-- Taken care of via RPM verify -->
-<!-- 6.1.4 Set User/Group Owner and Permission on /etc/crontab (Scored) -->
+<!-- CIS 6.1.4 Set User/Group Owner and Permission on /etc/crontab (Scored) -->
<!-- Taken care of via RPM verify -->
-<!-- 6.1.5 Set User/Group Owner and Permission on /etc/cron.hourly (Scored) -->
+<!-- CIS 6.1.5 Set User/Group Owner and Permission on /etc/cron.hourly (Scored)
-->
<!-- Taken care of via RPM verify -->
-<!-- 6.1.6 Set User/Group Owner and Permission on /etc/cron.daily (Scored) -->
+<!-- CIS 6.1.6 Set User/Group Owner and Permission on /etc/cron.daily (Scored) -->
<!-- Taken care of via RPM verify -->
-<!-- 6.1.7 Set User/Group Owner and Permission on /etc/cron.weekly (Scored) -->
+<!-- CIS 6.1.7 Set User/Group Owner and Permission on /etc/cron.weekly (Scored)
-->
<!-- Taken care of via RPM verify -->
-<!-- 6.1.8 Set User/Group Owner and Permission on /etc/cron.monthly (Scored) -->
+<!-- CIS 6.1.8 Set User/Group Owner and Permission on /etc/cron.monthly (Scored)
-->
<!-- Taken care of via RPM verify -->
-<!-- 6.1.9 Set User/Group Owner and Permission on /etc/cron.d (Scored) -->
+<!-- CIS 6.1.9 Set User/Group Owner and Permission on /etc/cron.d (Scored) -->
<!-- Taken care of via RPM verify -->
-<!-- 6.1.10 Restrict at Daemon (Scored) -->
+<!-- CIS 6.1.10 Restrict at Daemon (Scored) -->
<select idref="service_atd_disabled" selected="true" />
-<!-- 6.1.11 Restrict at/cron to Authorized Users (Scored) -->
+<!-- CIS 6.1.11 Restrict at/cron to Authorized Users (Scored) -->
<!-- Handled by rule immediately above -->
-<!-- 6.2 Configure SSH -->
-<!-- 6.2.1 Set SSH Protocol to 2 (Scored) -->
+<!-- CIS 6.2 Configure SSH -->
+<!-- CIS 6.2.1 Set SSH Protocol to 2 (Scored) -->
<select idref="sshd_allow_only_protocol2" selected="true" />
-<!-- 6.2.2 Set LogLevel to INFO (Scored) -->
+<!-- CIS 6.2.2 Set LogLevel to INFO (Scored) -->
<!-- Default, non-configurable system behavior, will audit user login/logout events
-->
-<!-- 6.2.3 Set Permissions on /etc/ssh/sshd_config (Scored) -->
+<!-- CIS 6.2.3 Set Permissions on /etc/ssh/sshd_config (Scored) -->
<!-- Met via RPM Verify rule -->
-<!-- 6.2.4 Disable SSH X11 Forwarding (Scored)-->
+<!-- CIS 6.2.4 Disable SSH X11 Forwarding (Scored)-->
<!-- Met through removal of X11 via Section 3.2 -->
-<!-- 6.2.5 Set SSH MaxAuthTries to 4 or Less (Scored) -->
+<!-- CIS 6.2.5 Set SSH MaxAuthTries to 4 or Less (Scored) -->
<!-- Met via 6.3.2 Set Password Creation Requirement Parameters Using pam_cracklib
-->
-<!-- 6.2.6 Set SSH IgnoreRhosts to Yes (Scored) -->
+<!-- CIS 6.2.6 Set SSH IgnoreRhosts to Yes (Scored) -->
<select idref="sshd_disable_rhosts" selected="true" />
-<!-- 6.2.7 Set SSH HostbasedAuthentication to No (Scored) -->
+<!-- CIS 6.2.7 Set SSH HostbasedAuthentication to No (Scored) -->
<select idref="disable_host_auth" selected="true" />
-<!-- 6.2.8 Disable SSH Root Login (Scored) -->
+<!-- CIS 6.2.8 Disable SSH Root Login (Scored) -->
<select idref="sshd_disable_root_login" selected="true" />
-<!-- 6.2.9 Set SSH PermitEmptyPasswords to No (Scored) -->
+<!-- CIS 6.2.9 Set SSH PermitEmptyPasswords to No (Scored) -->
<select idref="sshd_disable_empty_passwords" selected="true"
/>
-<!-- 6.2.10 Do Not Allow Users to Set Environment Options (Scored) -->
-<!-- 6.2.11 Use Only Approved Cipher in Counter Mode (Scored) -->
+<!-- CIS 6.2.10 Do Not Allow Users to Set Environment Options (Scored) -->
+<!-- CIS 6.2.11 Use Only Approved Cipher in Counter Mode (Scored) -->
<select idref="sshd_use_approved_ciphers" selected="true" />
-<!-- 6.2.12 Set Idle Timeout Interval for User Login (Scored) -->
+<!-- CIS 6.2.12 Set Idle Timeout Interval for User Login (Scored) -->
<select idref="sshd_set_idle_timeout" selected="true" />
-<!-- 6.2.13 Limit Access via SSH (Scored)-->
+<!-- CIS 6.2.13 Limit Access via SSH (Scored)-->
<select idref="sshd_limit_user_access" selected="true" />
-<!-- 6.2.14 Set SSH Banner (Scored) -->
+<!-- CIS 6.2.14 Set SSH Banner (Scored) -->
<select idref="sshd_enable_warning_banner" selected="true" />
-<!-- 6.3 Configure PAM -->
-<!-- 6.3.1 Upgrade Password Hashing Algorithm to SHA-512 (Scored) -->
+<!-- CIS 6.3 Configure PAM -->
+<!-- CIS 6.3.1 Upgrade Password Hashing Algorithm to SHA-512 (Scored) -->
<select idref="set_password_hashing_algorithm" selected="true"
/>
-<!-- 6.3.2 Set Password Creation Requirement Parameters Using pam_cracklib (Scored)
142 -->
+<!-- CIS 6.3.2 Set Password Creation Requirement Parameters Using pam_cracklib
(Scored) 142 -->
<select idref="password_quality_pamcracklib" selected="true"
/>
-<!-- 6.3.3 Set Lockout for Failed Password Attempts (Not Scored) -->
+<!-- CIS 6.3.3 Set Lockout for Failed Password Attempts (Not Scored) -->
<select idref="accounts_passwords_pam_faillock_deny"
selected="true" />
-<!-- 6.3.4 Limit Password Reuse (Scored) -->
+<!-- CIS 6.3.4 Limit Password Reuse (Scored) -->
<select idref="accounts_password_reuse_limit" selected="true"
/>
-<!-- 6.4 Restrict root Login to System Console (Not Scored) -->
+<!-- CIS 6.4 Restrict root Login to System Console (Not Scored) -->
<select idref="no_direct_root_logins" selected="true" />
-<!-- 6.5 Restrict Access to the su Command (Scored) -->
+<!-- CIS 6.5 Restrict Access to the su Command (Scored) -->
<!-- This rule was inherited from the RHEL5 STIG, which provided misinterpretted
guidance that sudo users must be in the "wheel" group. This guidance
has since been removed. Will work with CIS to drop this requirement -->
-<!-- 7 User Accounts and Environment -->
-<!-- 7.1 Set Shadow Password Suite Parameters (/etc/login.defs) -->
-<!-- 7.1.1 Set Password Expiration Days (Scored) -->
+<!-- CIS 7 User Accounts and Environment -->
+<!-- CIS 7.1 Set Shadow Password Suite Parameters (/etc/login.defs) -->
+<!-- CIS 7.1.1 Set Password Expiration Days (Scored) -->
<select idref="accounts_maximum_age_login_defs" selected="true"
/>
-<!-- 7.1.2 Set Password Change Minimum Number of Days (Scored) -->
+<!-- CIS 7.1.2 Set Password Change Minimum Number of Days (Scored) -->
<select idref="accounts_minimum_age_login_defs" selected="true"
/>
-<!-- 7.1.3 Set Password Expiring Warning Days (Scored) -->
+<!-- CIS 7.1.3 Set Password Expiring Warning Days (Scored) -->
<select idref="accounts_password_warn_age_login_defs"
selected="true" />
-<!-- 7.2 Disable System Accounts (Scored) -->
+<!-- CIS 7.2 Disable System Accounts (Scored) -->
<select idref="no_shelllogin_for_systemaccounts" selected="true"
/>
-<!-- 7.3 Set Default Group for root Account (Scored) -->
+<!-- CIS 7.3 Set Default Group for root Account (Scored) -->
<!-- The system default is GID 0. Any alterations
will be audited via 5.2.5 "Record Events That
Modify User/Group Information" -->
-<!-- 7.4 Set Default umask for Users (Scored) -->
+<!-- CIS 7.4 Set Default umask for Users (Scored) -->
<select idref="accounts_umask_bashrc" selected="true" />
<select idref="accounts_umask_etc_profile" selected="true" />
-<!-- 7.5 Lock Inactive User Accounts (Scored) -->
+<!-- CIS 7.5 Lock Inactive User Accounts (Scored) -->
<select idref="account_disable_post_pw_expiration" selected="true"
/>
-<!-- 8 Warning Banners -->
+<!-- CIS 8 Warning Banners -->
-<!-- 8.1 Set Warning Banner for Standard Login Services (Scored) -->
+<!-- CIS 8.1 Set Warning Banner for Standard Login Services (Scored) -->
<select idref="set_system_login_banner" selected="true" />
-<!-- 8.2 Remove OS Information from Login Warning Banners (Scored) -->
+<!-- CIS 8.2 Remove OS Information from Login Warning Banners (Scored) -->
<!-- Handled in Section 8.1 -->
-<!-- 8.3 Set GNOME Warning Banner (Not Scored) -->
+<!-- CIS 8.3 Set GNOME Warning Banner (Not Scored) -->
<select idref="enable_gdm_login_banner" selected="true" />
<select idref="set_gdm_login_banner_text" selected="true" />
-<!-- 9 System Maintenance -->
-<!-- 9.1 Verify System File Permissions -->
-<!-- 9.1.1 Verify System File Permissions (Not Scored) -->
+<!-- CIS 9 System Maintenance -->
+<!-- CIS 9.1 Verify System File Permissions -->
+<!-- CIS 9.1.1 Verify System File Permissions (Not Scored) -->
<!-- Duplicate of 1.2.6 -->
-<!-- 9.1.2 Verify Permissions on /etc/passwd (Scored) -->
+<!-- CIS 9.1.2 Verify Permissions on /etc/passwd (Scored) -->
<select idref="file_permissions_etc_passwd" selected="true" />
-<!-- 9.1.3 Verify Permissions on /etc/shadow (Scored) -->
+<!-- CIS 9.1.3 Verify Permissions on /etc/shadow (Scored) -->
<select idref="file_permissions_etc_shadow" selected="true" />
-<!-- 9.1.4 Verify Permissions on /etc/gshadow (Scored) -->
+<!-- CIS 9.1.4 Verify Permissions on /etc/gshadow (Scored) -->
<select idref="file_permissions_etc_gshadow" selected="true"
/>
-<!-- 9.1.5 Verify Permissions on /etc/group (Scored) -->
+<!-- CIS 9.1.5 Verify Permissions on /etc/group (Scored) -->
<select idref="file_permissions_etc_group" selected="true" />
-<!-- 9.1.6 Verify User/Group Ownership on /etc/passwd (Scored) -->
+<!-- CIS 9.1.6 Verify User/Group Ownership on /etc/passwd (Scored) -->
<select idref="file_owner_etc_passwd" selected="true" />
<select idref="file_groupowner_etc_passwd" selected="true" />
-<!-- 9.1.7 Verify User/Group Ownership on /etc/shadow (Scored) -->
+<!-- CIS 9.1.7 Verify User/Group Ownership on /etc/shadow (Scored) -->
<select idref="userowner_shadow_file" selected="true" />
<select idref="groupowner_shadow_file" selected="true" />
-<!-- 9.1.8 Verify User/Group Ownership on /etc/gshadow (Scored) -->
+<!-- CIS 9.1.8 Verify User/Group Ownership on /etc/gshadow (Scored) -->
<select idref="file_owner_etc_gshadow" selected="true" />
<select idref="file_groupowner_etc_gshadow" selected="true" />
-<!-- 9.1.9 Verify User/Group Ownership on /etc/group (Scored) -->
+<!-- CIS 9.1.9 Verify User/Group Ownership on /etc/group (Scored) -->
<select idref="file_owner_etc_group" selected="true" />
<select idref="file_groupowner_etc_group" selected="true" />
-<!-- 9.1.10 Find World Writable Files (Not Scored) -->
+<!-- CIS 9.1.10 Find World Writable Files (Not Scored) -->
<select idref="file_permissions_binary_dirs" selected="true"
/>
<select idref="world_writeable_files" selected="true" />
-<!-- 9.1.11 Find Un-owned Files and Directories (Scored) -->
+<!-- CIS 9.1.11 Find Un-owned Files and Directories (Scored) -->
<select idref="no_files_unowned_by_user" selected="true" />
-<!-- 9.1.12 Find Un-grouped Files and Directories (Scored) -->
+<!-- CIS 9.1.12 Find Un-grouped Files and Directories (Scored) -->
<select idref="no_files_unowned_by_group" selected="true" />
-<!-- 9.1.13 Find SUID System Executables (Not Scored) -->
+<!-- CIS 9.1.13 Find SUID System Executables (Not Scored) -->
<select idref="no_unpackaged_suid_files" selected="true" />
-<!-- 9.1.14 Find SGID System Executables (Not Scored) -->
+<!-- CIS 9.1.14 Find SGID System Executables (Not Scored) -->
<select idref="no_unpackaged_sgid_files" selected="true" />
-<!-- 9.2 Review User and Group Settings -->
-<!-- 9.2.1 Ensure Password Fields are Not Empty (Scored) -->
+<!-- CIS 9.2 Review User and Group Settings -->
+<!-- CIS 9.2.1 Ensure Password Fields are Not Empty (Scored) -->
<select idref="no_empty_passwords" selected="true" />
-<!-- 9.2.2 Verify No Legacy "+" Entries Exist in /etc/passwd File (Scored)
-->
+<!-- CIS 9.2.2 Verify No Legacy "+" Entries Exist in /etc/passwd File
(Scored) -->
<!-- Addressed from removal of NIS in "2.1.6 Remove NIS Server" -->
-<!-- 9.2.3 Verify No Legacy "+" Entries Exist in /etc/shadow File (Scored)
-->
+<!-- CIS 9.2.3 Verify No Legacy "+" Entries Exist in /etc/shadow File
(Scored) -->
<!-- Addressed from removal of NIS in "2.1.6 Remove NIS Server" -->
-<!-- 9.2.4 Verify No Legacy "+" Entries Exist in /etc/group File (Scored)
-->
+<!-- CIS 9.2.4 Verify No Legacy "+" Entries Exist in /etc/group File
(Scored) -->
<!-- Addressed from removal of NIS in "2.1.6 Remove NIS Server" -->
-<!-- 9.2.5 Verify No UID 0 Accounts Exist Other Than root (Scored) -->
+<!-- CIS 9.2.5 Verify No UID 0 Accounts Exist Other Than root (Scored) -->
<select idref="accounts_no_uid_except_zero" selected="true" />
-<!-- 9.2.6 Ensure root PATH Integrity (Scored) -->
+<!-- CIS 9.2.6 Ensure root PATH Integrity (Scored) -->
<select idref="root_path_default" selected="true" />
-<!-- 9.2.7 Check Permissions on User Home Directories (Scored) -->
+<!-- CIS 9.2.7 Check Permissions on User Home Directories (Scored) -->
<select idref="homedir_perms_no_groupwrite_worldread"
selected="true" />
-<!-- 9.2.8 Check User Dot File Permissions (Scored) -->
+<!-- CIS 9.2.8 Check User Dot File Permissions (Scored) -->
<!-- Addressed via 9.1.10 Find World Writable Files -->
-<!-- 9.2.9 Check Permissions on User .netrc Files (Scored)-->
+<!-- CIS 9.2.9 Check Permissions on User .netrc Files (Scored)-->
<!-- Addressed via 9.1.10 Find World Writable Files -->
-<!-- 9.2.10 Check for Presence of User .rhosts Files (Scored) -->
+<!-- CIS 9.2.10 Check for Presence of User .rhosts Files (Scored) -->
<select idref="no_rsh_trust_files" selected="true" />
-<!-- 9.2.11 Check Groups in /etc/passwd (Scored) -->
+<!-- CIS 9.2.11 Check Groups in /etc/passwd (Scored) -->
<select idref="gid_passwd_group_same" selected="true" />
-<!-- 9.2.12 Check That Users Are Assigned Valid Home Directories (Scored) -->
+<!-- CIS 9.2.12 Check That Users Are Assigned Valid Home Directories (Scored) -->
<!-- The useradd tool addresses this problem natively. Will work with CIS
to remove this check -->
-<!-- 9.2.13 Check User Home Directory Ownership (Scored) -->
+<!-- CIS 9.2.13 Check User Home Directory Ownership (Scored) -->
<!-- Default system behavior reflects that if user does not
own their assigned home directory, they will not
have privileges upon it -->
-<!-- 9.2.14 Check for Duplicate UIDs (Scored)-->
+<!-- CIS 9.2.14 Check for Duplicate UIDs (Scored)-->
<select idref="account_unique_name" selected="true" />
-<!-- 9.2.15 Check for Duplicate GIDs (Scored) -->
+<!-- CIS 9.2.15 Check for Duplicate GIDs (Scored) -->
<!-- Duplicate of 9.2.14 -->
-<!-- 9.2.16 Check That Reserved UIDs Are Assigned to System Accounts (Scored) -->
+<!-- CIS 9.2.16 Check That Reserved UIDs Are Assigned to System Accounts (Scored)
-->
<!-- Duplicate of 9.2.14 -->
-<!-- 9.2.17 Check for Duplicate User Names (Scored) -->
+<!-- CIS 9.2.17 Check for Duplicate User Names (Scored) -->
<!-- Duplicate of 9.2.14 -->
-<!-- 9.2.18 Check for Duplicate Group Names (Scored) -->
-<!-- Duplicate of 9.2.14 -->
+<!-- CIS 9.2.18 Check for Duplicate Group Names (Scored) -->
+<!-- CIS Duplicate of 9.2.14 -->
-<!-- 9.2.19 Check for Presence of User .netrc Files (Scored) -->
+<!-- CIS 9.2.19 Check for Presence of User .netrc Files (Scored) -->
<select idref="no_netrc_files" selected="true" />
-<!-- 9.2.20 Check for Presence of User .forward Files (Scored) -->
+<!-- CIS 9.2.20 Check for Presence of User .forward Files (Scored) -->
<!-- This rule was inherited from RHEL5 STIG guidance, and since removed
from industry best practices. Will work with CIS to remove requirement. -->
--
1.7.1