Skip to content

Commit 1e4eee3

Browse files
jan-cernyjan-cerny
authored
Merge pull request #11976 from Mab879/init_rhel10_e8
Initial RHEL 10 e8 Profile
2 parents bca5d4b + dbc0e42 commit 1e4eee3

2 files changed

Lines changed: 219 additions & 0 deletions

File tree

‎controls/e8.yml‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
id: 'e8'
2+
policy: 'e8'
3+
source: 'https://www.cyber.gov.au/sites/default/files/2023-11/PROTECT%20-%20Hardening%20Linux%20Workstations%20and%20Servers%20%28November%202023%29.pdf'
4+
title: 'Australian Cyber Security Centre (ACSC)'
5+
levels:
6+
- id: base
7+
8+
controls:
9+
- id: 'patching'
10+
levels:
11+
- base
12+
title: 'Application and operating system patching'
13+
rules:
14+
- package_talk_removed
15+
- package_talk-server_removed
16+
- package_ypbind_removed
17+
- package_telnet_removed
18+
- service_telnet_disabled
19+
- package_telnet-server_removed
20+
- package_rsh_removed
21+
- package_rsh-server_removed
22+
- package_quagga_removed
23+
- service_avahi-daemon_disabled
24+
- package_squid_removed
25+
- service_squid_disabled
26+
- ensure_redhat_gpgkey_installed
27+
- ensure_gpgcheck_never_disabled
28+
- ensure_gpgcheck_local_packages
29+
- ensure_gpgcheck_globally_activated
30+
- security_patches_up_to_date
31+
- dnf-automatic_security_updates_only
32+
status: automated
33+
34+
- id: 'mfa'
35+
levels:
36+
- base
37+
title: 'Multi-factor authentication'
38+
status: manual
39+
40+
- id: 'restrict_admin'
41+
levels:
42+
- base
43+
title: 'Restricting administrative privileges'
44+
rules:
45+
- accounts_no_uid_except_zero
46+
- sudo_remove_nopasswd
47+
- sudo_remove_no_authenticate
48+
- sudo_require_authentication
49+
50+
status: partial
51+
52+
- id: 'app_control'
53+
levels:
54+
- base
55+
title: 'Application control'
56+
rules:
57+
- package_fapolicyd_installed
58+
- service_fapolicyd_enabled
59+
status: partial
60+
61+
- id: 'restrict_macros'
62+
levels:
63+
- base
64+
title: 'Restrict Microsoft Office macros'
65+
status: not applicable
66+
67+
- id: 'app_hardening'
68+
levels:
69+
- base
70+
title: 'User application hardening'
71+
status: pending
72+
73+
- id: 'backups'
74+
levels:
75+
- base
76+
title: 'Regular backups'
77+
rules:
78+
- package_rear_installed
79+
status: partial
80+
81+
- id: 'hardening'
82+
levels:
83+
- base
84+
title: 'General hardening of {{{ full_name }}}'
85+
rules:
86+
- var_system_crypto_policy=default_nosha1
87+
- configure_crypto_policy
88+
- configure_ssh_crypto_policy
89+
### Secure access
90+
- sshd_use_directory_configuration
91+
- sshd_disable_root_login
92+
- sshd_disable_gssapi_auth
93+
- sshd_print_last_log
94+
- sshd_do_not_permit_user_env
95+
- sshd_disable_rhosts
96+
- sshd_set_loglevel_info
97+
- sshd_disable_empty_passwords
98+
- sshd_disable_user_known_hosts
99+
- sshd_enable_strictmodes
100+
### Audit
101+
- package_rsyslog_installed
102+
- service_rsyslog_enabled
103+
- service_auditd_enabled
104+
- var_auditd_flush=incremental_async
105+
- auditd_data_retention_flush
106+
- auditd_local_events
107+
- auditd_write_logs
108+
- auditd_log_format
109+
- auditd_freq
110+
- auditd_name_format
111+
- audit_rules_login_events_tallylog
112+
- audit_rules_login_events_faillock
113+
- audit_rules_login_events_lastlog
114+
- audit_rules_login_events
115+
- audit_rules_time_adjtimex
116+
- audit_rules_time_clock_settime
117+
- audit_rules_time_watch_localtime
118+
- audit_rules_time_settimeofday
119+
- audit_rules_time_stime
120+
- audit_rules_execution_restorecon
121+
- audit_rules_execution_chcon
122+
- audit_rules_execution_semanage
123+
- audit_rules_execution_setsebool
124+
- audit_rules_execution_setfiles
125+
- audit_rules_execution_seunshare
126+
- audit_rules_sysadmin_actions
127+
- audit_rules_networkconfig_modification
128+
- audit_rules_usergroup_modification
129+
- audit_rules_dac_modification_chmod
130+
- audit_rules_dac_modification_chown
131+
- audit_rules_kernel_module_loading
132+
133+
### System security settings
134+
- sysctl_kernel_randomize_va_space
135+
- sysctl_kernel_exec_shield
136+
- sysctl_kernel_kptr_restrict
137+
- sysctl_kernel_dmesg_restrict
138+
- sysctl_kernel_kexec_load_disabled
139+
- sysctl_kernel_yama_ptrace_scope
140+
- sysctl_kernel_unprivileged_bpf_disabled
141+
- sysctl_net_core_bpf_jit_harden
142+
143+
### SELinux
144+
- var_selinux_state=enforcing
145+
- selinux_state
146+
- var_selinux_policy_name=targeted
147+
- selinux_policytype
148+
149+
### Filesystem integrity
150+
- rpm_verify_hashes
151+
- rpm_verify_permissions
152+
- rpm_verify_ownership
153+
- file_permissions_unauthorized_sgid
154+
- file_permissions_unauthorized_suid
155+
- file_permissions_unauthorized_world_writable
156+
- dir_perms_world_writable_sticky_bits
157+
- file_permissions_library_dirs
158+
- file_ownership_binary_dirs
159+
- file_permissions_binary_dirs
160+
- file_ownership_library_dirs
161+
162+
### Passwords
163+
- var_authselect_profile=sssd
164+
- enable_authselect
165+
- no_empty_passwords
166+
167+
### Partitioning
168+
- mount_option_dev_shm_nodev
169+
- mount_option_dev_shm_nosuid
170+
- mount_option_dev_shm_noexec
171+
172+
### Network
173+
- package_firewalld_installed
174+
- service_firewalld_enabled
175+
- network_sniffer_disabled
176+
177+
status: partial # Always will be partial as more could be done

‎products/rhel10/profiles/e8.profile‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
documentation_complete: true
2+
3+
metadata:
4+
SMEs:
5+
- shaneboulden
6+
- tjbutt58
7+
8+
reference: https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
9+
10+
title: 'Australian Cyber Security Centre (ACSC) Essential Eight'
11+
12+
description: |-
13+
This profile contains configuration checks for Red Hat Enterprise Linux 10
14+
that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
15+
16+
A copy of the Essential Eight in Linux Environments guide can be found at the
17+
ACSC website:
18+
19+
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
20+
21+
selections:
22+
- e8:all
23+
# audit-audispd-plugins package does not exist in RHEL 10 (based on RHEL 9)
24+
# use only package_audispd-plugins_installed
25+
- '!package_audit-audispd-plugins_installed'
26+
# More tests are needed to identify which rule is conflicting with rpm_verify_permissions.
27+
# https://github.com/ComplianceAsCode/content/issues/11285
28+
- '!rpm_verify_permissions'
29+
- '!package_talk_removed'
30+
- '!package_talk-server_removed'
31+
- '!package_ypbind_removed'
32+
- '!package_audit-audispd-plugins_installed'
33+
- '!set_ipv6_loopback_traffic'
34+
- '!set_loopback_traffic'
35+
- '!service_ntpd_enabled'
36+
- '!package_ypserv_removed'
37+
- '!package_ypbind_removed'
38+
- '!package_talk_removed'
39+
- '!package_talk-server_removed'
40+
- '!package_xinetd_removed'
41+
- '!package_rsh_removed'
42+
- '!package_rsh-server_removed'

0 commit comments

Comments
 (0)